diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1edc3a67..0bb912a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,11 +15,13 @@ All notable changes to this project will be documented in this file.
 - When creating a VSI Deployment, users can select a new toggle `Include Name Variables`. When this value is set to true, VSI names will be populated as variables in Terrafrom. This allows for users to have full control over VSI names without needing to directly modify Terraform scripts
 - Power VS Virtual Server and FalconStor VTL system types are now retrieved dynamically using the Power VS API based on the zone
 - Power Edge Router is now supported for `syd05`
+- When updating a VPC's Public Gateways, invalid gateways will automatically be removed from subnets where they are enabled
 
 ### Fixes
 
 - Fixed an issue causing Power VS API endpoints for Sao Palo availability zones to fail
 - Fixed an issue causing VPC subnets to incorrectly have `public_gateway` set to true when no public gateway is created in the corresponding zone
+- Fixed an issue causing the Resource Group field for Key Management services to not be rendered when using a resource from data
 
 ## 1.13.1
 
diff --git a/client/src/lib/docs/release-notes.json b/client/src/lib/docs/release-notes.json
index de9c5ab4..458ad036 100644
--- a/client/src/lib/docs/release-notes.json
+++ b/client/src/lib/docs/release-notes.json
@@ -7,11 +7,13 @@
       "Users can now provision VPC VSI deployments using an existing volume snapshot by using the `Create VSI From Snapshot` toggle. A list of snapshots will be dynamically retrieved using the IBM Cloud API based on the region selected in your project",
       "When creating a VSI Deployment, users can select a new toggle `Include Name Variables`. When this value is set to true, VSI names will be populated as variables in Terrafrom. This allows for users to have full control over VSI names without needing to directly modify Terraform scripts",
       "Power VS Virtual Server and FalconStor VTL system types are now retrieved dynamically using the Power VS API based on the zone",
-      "Power Edge Router is now supported for `syd05`"
+      "Power Edge Router is now supported for `syd05`",
+      "When updating a VPC's Public Gateways, invalid gateways will automatically be removed from subnets where they are enabled"
     ],
     "fixes": [
       "Fixed an issue causing Power VS API endpoints for Sao Palo availability zones to fail",
-      "Fixed an issue causing VPC subnets to incorrectly have `public_gateway` set to true when no public gateway is created in the corresponding zone"
+      "Fixed an issue causing VPC subnets to incorrectly have `public_gateway` set to true when no public gateway is created in the corresponding zone",
+      "Fixed an issue causing the Resource Group field for Key Management services to not be rendered when using a resource from data"
     ],
     "upgrade_notes": []
   },
diff --git a/client/src/lib/state/key-management.js b/client/src/lib/state/key-management.js
index 3f1a7c6d..e33d625b 100644
--- a/client/src/lib/state/key-management.js
+++ b/client/src/lib/state/key-management.js
@@ -252,7 +252,9 @@ function initKeyManagement(store) {
         },
       },
       name: nameField("key_management"),
-      resource_group: resourceGroupsField(),
+      resource_group: resourceGroupsField(false, {
+        noHideWhen: true,
+      }),
       authorize_vpc_reader_role: {
         type: "toggle",
         default: true,
diff --git a/client/src/lib/state/utils.js b/client/src/lib/state/utils.js
index 24d380e2..087f85b6 100644
--- a/client/src/lib/state/utils.js
+++ b/client/src/lib/state/utils.js
@@ -429,7 +429,9 @@ function isIpStringInvalid(value) {
 function resourceGroupsField(small, options) {
   return {
     default: "",
-    invalid: options?.invalid
+    invalid: options?.noHideWhen
+      ? fieldIsNullOrEmptyString("resource_group", true)
+      : options?.invalid
       ? options.invalid
       : fieldIsNullOrEmptyString("resource_group"),
     invalidText: selectInvalidText("resource group"),
@@ -437,7 +439,7 @@ function resourceGroupsField(small, options) {
     groups: function (stateData, componentProps) {
       return splat(componentProps.craig.store.json.resource_groups, "name");
     },
-    hideWhen: hideWhenUseData,
+    hideWhen: options?.noHideWhen ? undefined : hideWhenUseData,
     size: small ? "small" : undefined,
     labelText: options?.labelText || undefined,
   };
diff --git a/client/src/lib/state/vpc/vpc.js b/client/src/lib/state/vpc/vpc.js
index 3fa39aef..ab9207a2 100644
--- a/client/src/lib/state/vpc/vpc.js
+++ b/client/src/lib/state/vpc/vpc.js
@@ -241,6 +241,10 @@ function vpcOnStoreUpdate(config) {
       ) {
         subnet.network_acl = null;
       }
+
+      if (!contains(network.publicGateways || [], subnet.zone)) {
+        subnet.public_gateway = false;
+      }
     });
     network.acls.forEach((acl) => {
       if (isNullOrEmptyString(acl.use_data, true)) {
diff --git a/unit-tests/forms/disable-save.test.js b/unit-tests/forms/disable-save.test.js
index 75f8adca..c8b9f2e6 100644
--- a/unit-tests/forms/disable-save.test.js
+++ b/unit-tests/forms/disable-save.test.js
@@ -88,12 +88,15 @@ describe("disableSave", () => {
     it("should not force a vpn gateway form open when a connection has a valid peer address", () => {
       assert.isFalse(
         forceShowForm(
-          {},
+          {
+            resource_group: "yes",
+          },
           {
             submissionFieldName: "vpn_gateways",
             innerFormProps: {
               data: {
                 name: "vpn-gw",
+                resource_group: "frog",
                 connections: [
                   {
                     name: "hi",
diff --git a/unit-tests/forms/disable-save/power.test.js b/unit-tests/forms/disable-save/power.test.js
index cedf2ea0..6264a255 100644
--- a/unit-tests/forms/disable-save/power.test.js
+++ b/unit-tests/forms/disable-save/power.test.js
@@ -109,6 +109,7 @@ describe("power", () => {
         ],
         imageNames: ["7200-05-05"],
         zone: "dal12",
+        resource_group: "hello",
       },
       {
         arrayParentName: "workspace",
diff --git a/unit-tests/state/appid.test.js b/unit-tests/state/appid.test.js
index 92925505..db30631b 100644
--- a/unit-tests/state/appid.test.js
+++ b/unit-tests/state/appid.test.js
@@ -13,44 +13,40 @@ function newState() {
 }
 
 describe("appid", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("appid.init", () => {
     it("should initialize appid", () => {
-      let state = new newState();
       let expectedData = [];
       assert.deepEqual(
-        state.store.json.appid,
+        craig.store.json.appid,
         expectedData,
         "it should have appid initialized"
       );
     });
   });
   describe("appid crud functions", () => {
-    let appidState;
-    beforeEach(() => {
-      appidState = new newState();
-    });
     describe("appid on store update", () => {
-      beforeEach(() => {
-        appidState = new newState();
-      });
       it("should add keys to object when unfound", () => {
-        appidState.appid.create({
+        craig.appid.create({
           name: "frog",
         });
         assert.deepEqual(
-          appidState.store.json.appid,
+          craig.store.json.appid,
           [{ name: "frog", keys: [], resource_group: null }],
           "it should set keys"
         );
       });
       it("should set encryption key to null when deleted", () => {
-        appidState.appid.create({
+        craig.appid.create({
           name: "default",
           keys: [],
           kms: "kms",
           encryption_key: "key",
         });
-        appidState.key_management.keys.delete(
+        craig.key_management.keys.delete(
           {},
           {
             arrayParentName: "kms",
@@ -59,19 +55,19 @@ describe("appid", () => {
           }
         );
         assert.deepEqual(
-          appidState.store.json.appid[0].encryption_key,
+          craig.store.json.appid[0].encryption_key,
           null,
           "it should be null"
         );
       });
       it("should set encryption key and kms to null when kms deleted", () => {
-        appidState.appid.create({
+        craig.appid.create({
           name: "default",
           keys: [],
           kms: "kms",
           encryption_key: "key",
         });
-        appidState.key_management.delete(
+        craig.key_management.delete(
           {},
           {
             data: { name: "kms" },
@@ -79,21 +75,21 @@ describe("appid", () => {
           }
         );
         assert.deepEqual(
-          appidState.store.json.appid[0].kms,
+          craig.store.json.appid[0].kms,
           null,
           "it should be null"
         );
         assert.deepEqual(
-          appidState.store.json.appid[0].encryption_key,
+          craig.store.json.appid[0].encryption_key,
           null,
           "it should be null"
         );
       });
     });
     it("should add an appid instance", () => {
-      appidState.appid.create({ name: "default", keys: [] });
+      craig.appid.create({ name: "default", keys: [] });
       assert.deepEqual(
-        appidState.store.json.appid,
+        craig.store.json.appid,
         [
           {
             name: "default",
@@ -105,41 +101,29 @@ describe("appid", () => {
       );
     });
     it("should save an appid instance", () => {
-      appidState.appid.create({ name: "default", keys: [] });
-      appidState.appid.save(
+      craig.appid.create({ name: "default", keys: [] });
+      craig.appid.save(
         { resource_group: "service-rg" },
         { data: { name: "default" } }
       );
       assert.deepEqual(
-        appidState.store.json.appid,
-        [
-          {
-            name: "default",
-            resource_group: "service-rg",
-            keys: [],
-          },
-        ],
+        craig.store.json.appid[0].resource_group,
+        "service-rg",
         "it should create appid"
       );
     });
     it("should delete an appid instance", () => {
-      appidState.appid.create({ name: "default", keys: [] });
-      appidState.appid.delete({}, { data: { name: "default" } });
-      assert.deepEqual(
-        appidState.store.json.appid,
-        [],
-        "it should create appid"
-      );
+      craig.appid.create({ name: "default", keys: [] });
+      craig.appid.delete({}, { data: { name: "default" } });
+      assert.deepEqual(craig.store.json.appid, [], "it should create appid");
     });
   });
   describe("appid key crud functions", () => {
-    let appidState;
     beforeEach(() => {
-      appidState = new newState();
-      appidState.appid.create({ name: "default", keys: [] });
+      craig.appid.create({ name: "default", keys: [] });
     });
     it("should add an appid instance", () => {
-      appidState.appid.keys.create(
+      craig.appid.keys.create(
         {
           name: "test",
         },
@@ -150,7 +134,7 @@ describe("appid", () => {
         }
       );
       assert.deepEqual(
-        appidState.store.json.appid,
+        craig.store.json.appid,
         [
           {
             name: "default",
@@ -167,7 +151,7 @@ describe("appid", () => {
       );
     });
     it("should save an appid instance", () => {
-      appidState.appid.keys.create(
+      craig.appid.keys.create(
         {
           name: "test",
         },
@@ -177,7 +161,7 @@ describe("appid", () => {
           },
         }
       );
-      appidState.appid.keys.save(
+      craig.appid.keys.save(
         { resource_group: "service-rg" },
         {
           data: { name: "test" },
@@ -185,7 +169,7 @@ describe("appid", () => {
         }
       );
       assert.deepEqual(
-        appidState.store.json.appid,
+        craig.store.json.appid,
         [
           {
             name: "default",
@@ -199,7 +183,7 @@ describe("appid", () => {
       );
     });
     it("should delete an appid key", () => {
-      appidState.appid.keys.create(
+      craig.appid.keys.create(
         {
           name: "test",
         },
@@ -209,7 +193,7 @@ describe("appid", () => {
           },
         }
       );
-      appidState.appid.keys.delete(
+      craig.appid.keys.delete(
         {},
         {
           data: { name: "test" },
@@ -217,7 +201,7 @@ describe("appid", () => {
         }
       );
       assert.deepEqual(
-        appidState.store.json.appid.keys.length,
+        craig.store.json.appid.keys.length,
         0,
         "it should delete appid key"
       );
@@ -227,7 +211,6 @@ describe("appid", () => {
     describe("appid form", () => {
       describe("appid.shouldDisableSave", () => {
         it("should return true if the name is invalid", () => {
-          let state = newState();
           let actualData = disableSave(
             "appid",
             {
@@ -235,7 +218,7 @@ describe("appid", () => {
               resource_group: null,
             },
             {
-              craig: state,
+              craig: craig,
               data: {
                 name: "",
               },
@@ -244,9 +227,8 @@ describe("appid", () => {
           assert.isTrue(actualData, "it should be disabled");
         });
         it("should return false when name is valid, rg is invalid, and use data", () => {
-          let state = newState();
           assert.isFalse(
-            state.appid.resource_group.invalid({
+            craig.appid.resource_group.invalid({
               name: "name",
               resource_group: "",
               use_data: true,
@@ -255,7 +237,6 @@ describe("appid", () => {
           );
         });
         it("should return true if name is valid and resource group is invalid", () => {
-          let state = newState();
           let actualData = disableSave(
             "appid",
             {
@@ -263,7 +244,7 @@ describe("appid", () => {
               resource_group: null,
             },
             {
-              craig: state,
+              craig: craig,
               data: {
                 name: "",
               },
@@ -274,11 +255,10 @@ describe("appid", () => {
       });
       describe("name", () => {
         it("should return true if appid has invalid name", () => {
-          let state = newState();
-          let actualData = state.appid.name.invalid(
+          let actualData = craig.appid.name.invalid(
             { name: "@@@" },
             {
-              craig: state,
+              craig: craig,
               data: {
                 name: "",
               },
@@ -287,11 +267,10 @@ describe("appid", () => {
           assert.isTrue(actualData, "it should return true if name is invalid");
         });
         it("should return correct invalid text when appid has invalid name", () => {
-          let state = newState();
-          let actualData = state.appid.name.invalidText(
+          let actualData = craig.appid.name.invalidText(
             { name: "@@@" },
             {
-              craig: state,
+              craig: craig,
               data: {
                 name: "",
               },
@@ -304,12 +283,11 @@ describe("appid", () => {
           );
         });
         it("should return true if appid has invalid duplicate name", () => {
-          let state = newState();
-          state.appid.create({ name: "egg" });
-          let actualData = state.appid.name.invalid(
+          craig.appid.create({ name: "egg" });
+          let actualData = craig.appid.name.invalid(
             { name: "egg" },
             {
-              craig: state,
+              craig: craig,
               data: {
                 name: "",
               },
@@ -318,12 +296,11 @@ describe("appid", () => {
           assert.isTrue(actualData, "it should return true if name is invalid");
         });
         it("should return correct text if appid has invalid duplicate name", () => {
-          let state = newState();
-          state.appid.create({ name: "egg" });
-          let actualData = state.appid.name.invalidText(
+          craig.appid.create({ name: "egg" });
+          let actualData = craig.appid.name.invalidText(
             { name: "egg" },
             {
-              craig: state,
+              craig: craig,
               data: {
                 name: "",
               },
@@ -338,9 +315,8 @@ describe("appid", () => {
       });
       describe("encryption_keys", () => {
         it("should return correct groups for encryption keys", () => {
-          let state = newState();
           assert.deepEqual(
-            state.appid.encryption_key.groups({}, { craig: state }),
+            craig.appid.encryption_key.groups({}, { craig: craig }),
             ["key", "atracker-key", "vsi-volume-key", "roks-key"],
             "it should return groups"
           );
@@ -349,42 +325,37 @@ describe("appid", () => {
       describe("keys subform", () => {
         describe("name", () => {
           it("should return true if appid key has invalid name", () => {
-            let state = newState();
-            let actualData = state.appid.keys.name.invalid(
-              { name: "@@@" },
-              {
-                craig: state,
-                data: {
-                  name: "",
-                },
-              }
-            );
             assert.isTrue(
-              actualData,
+              craig.appid.keys.name.invalid(
+                { name: "@@@" },
+                {
+                  craig: craig,
+                  data: {
+                    name: "",
+                  },
+                }
+              ),
               "it should return true if name is invalid"
             );
           });
           it("should return correct text if appid key has invalid name", () => {
-            let state = newState();
-            let actualData = state.appid.keys.name.invalidText(
-              { name: "@@@" },
-              {
-                craig: state,
-                data: {
-                  name: "",
-                },
-              }
-            );
             assert.deepEqual(
-              actualData,
+              craig.appid.keys.name.invalidText(
+                { name: "@@@" },
+                {
+                  craig: craig,
+                  data: {
+                    name: "",
+                  },
+                }
+              ),
               "Name must follow the regex pattern: /^[A-z]([a-z0-9-]*[a-z0-9])*$/s",
               "it should return correct text"
             );
           });
           it("should return true if appid key has invalid duplicate name", () => {
-            let state = newState();
-            state.appid.create({ name: "egg" });
-            state.appid.keys.create(
+            craig.appid.create({ name: "egg" });
+            craig.appid.keys.create(
               { name: "egg" },
               {
                 innerFormProps: {
@@ -392,24 +363,22 @@ describe("appid", () => {
                 },
               }
             );
-            let actualData = state.appid.keys.name.invalid(
-              { name: "egg" },
-              {
-                craig: state,
-                data: {
-                  name: "",
-                },
-              }
-            );
             assert.isTrue(
-              actualData,
+              craig.appid.keys.name.invalid(
+                { name: "egg" },
+                {
+                  craig: craig,
+                  data: {
+                    name: "",
+                  },
+                }
+              ),
               "it should return true if name is invalid"
             );
           });
           it("should return correct text if appid key has invalid duplicate name", () => {
-            let state = newState();
-            state.appid.create({ name: "egg" });
-            state.appid.keys.create(
+            craig.appid.create({ name: "egg" });
+            craig.appid.keys.create(
               { name: "egg" },
               {
                 innerFormProps: {
@@ -417,17 +386,16 @@ describe("appid", () => {
                 },
               }
             );
-            let actualData = state.appid.keys.name.invalidText(
-              { name: "egg" },
-              {
-                craig: state,
-                data: {
-                  name: "aa",
-                },
-              }
-            );
             assert.deepEqual(
-              actualData,
+              craig.appid.keys.name.invalidText(
+                { name: "egg" },
+                {
+                  craig: craig,
+                  data: {
+                    name: "aa",
+                  },
+                }
+              ),
               'Name "egg" already in use',
               "it should return correct text"
             );
@@ -439,7 +407,7 @@ describe("appid", () => {
   describe("appid key function", () => {
     it("should disable save when invalid name", () => {
       assert.isTrue(
-        disableSave("keys", { name: "@@@" }, { craig: newState() }),
+        disableSave("keys", { name: "@@@" }, { craig: craig }),
         "it should be disabled"
       );
     });
diff --git a/unit-tests/state/atracker.test.js b/unit-tests/state/atracker.test.js
index 50b98d9a..f9b00834 100644
--- a/unit-tests/state/atracker.test.js
+++ b/unit-tests/state/atracker.test.js
@@ -1,6 +1,6 @@
 const { assert } = require("chai");
 const { state } = require("../../client/src/lib/state");
-const craig = state();
+
 /**
  * initialize store
  * @returns {lazyZState} state store
@@ -12,9 +12,12 @@ function newState() {
 }
 
 describe("atracker", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("atracker.init", () => {
     it("should have default atracker", () => {
-      let state = new newState();
       let expectedData = {
         enabled: true,
         type: "cos",
@@ -26,7 +29,7 @@ describe("atracker", () => {
         locations: ["global", "us-south"],
       };
       assert.deepEqual(
-        state.store.json.atracker,
+        craig.store.json.atracker,
         expectedData,
         "it should have atracker"
       );
@@ -34,13 +37,12 @@ describe("atracker", () => {
   });
   describe("atracker.onStoreUpdate", () => {
     it("should set cos_key to null if deleted", () => {
-      let state = new newState();
-      state.object_storage.keys.delete(
+      craig.object_storage.keys.delete(
         {},
         { arrayParentName: "atracker-cos", data: { name: "cos-bind-key" } }
       );
       assert.deepEqual(
-        state.store.json.atracker.cos_key,
+        craig.store.json.atracker.cos_key,
         null,
         "it should be null"
       );
@@ -48,44 +50,32 @@ describe("atracker", () => {
   });
   describe("atracker.save", () => {
     it("should update atracker info", () => {
-      let state = new newState();
       // create key
-      state.object_storage.keys.create(
+      craig.object_storage.keys.create(
         {
           name: "frog",
         },
         {
           innerFormProps: {
             arrayParentName: "cos",
-            arrayData: state.store.json.object_storage[0].keys,
+            arrayData: craig.store.json.object_storage[0].keys,
           },
         }
       );
       // save with different key
-      state.atracker.save({
+      craig.atracker.save({
         bucket: "management-bucket",
         add_route: false,
         cos_key: "frog",
       });
-      let expectedData = {
-        enabled: true,
-        type: "cos",
-        name: "atracker",
-        target_name: "cos",
-        bucket: "management-bucket",
-        add_route: false,
-        cos_key: "frog",
-        locations: ["global", "us-south"],
-      };
       assert.deepEqual(
-        state.store.json.atracker,
-        expectedData,
+        craig.store.json.atracker.cos_key,
+        "frog",
         "it should update"
       );
     });
     it("should update atracker target name when saving new bucket in different cos instance", () => {
-      let state = new newState();
-      state.store.json.object_storage.push({
+      craig.store.json.object_storage.push({
         name: "atracker",
         use_data: false,
         resource_group: "service-rg",
@@ -111,13 +101,13 @@ describe("atracker", () => {
           },
         ],
       });
-      state.atracker.save({
+      craig.atracker.save({
         bucket: "test-atracker-bucket",
         add_route: false,
         cos_key: "frog",
       });
       assert.deepEqual(
-        state.store.json.atracker.target_name,
+        craig.store.json.atracker.target_name,
         "atracker",
         "it should set target name"
       );
@@ -159,21 +149,21 @@ describe("atracker", () => {
     });
     it("should return the correct cos buckets", () => {
       assert.deepEqual(
-        newState().atracker.bucket.groups({}, { craig: newState() }),
+        craig.atracker.bucket.groups({}, { craig: craig }),
         ["atracker-bucket", "management-bucket", "workload-bucket"],
         "it should return list of cos buckets"
       );
     });
     it("should return the correct resource groups", () => {
       assert.deepEqual(
-        newState().atracker.resource_group.groups({}, { craig: newState() }),
+        craig.atracker.resource_group.groups({}, { craig: craig }),
         ["service-rg", "management-rg", "workload-rg"],
         "it should return list of resource groups"
       );
     });
     it("should return the correct cos keys", () => {
       assert.deepEqual(
-        newState().atracker.cos_key.groups({}, { craig: newState() }),
+        craig.atracker.cos_key.groups({}, { craig: craig }),
         ["cos-bind-key"],
         "it should return list of cos keys"
       );
diff --git a/unit-tests/state/cbr-rules.test.js b/unit-tests/state/cbr-rules.test.js
index e9b5a492..a6129e40 100644
--- a/unit-tests/state/cbr-rules.test.js
+++ b/unit-tests/state/cbr-rules.test.js
@@ -13,19 +13,18 @@ function newState() {
 }
 
 describe("cbr_rules", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("cbr_rules.init", () => {
     it("should initialize cbr_rules", () => {
-      let state = new newState();
-      assert.deepEqual(state.store.json.cbr_rules, []);
+      assert.deepEqual(craig.store.json.cbr_rules, []);
     });
   });
   describe("cbr_rules crud operations", () => {
-    let state;
-    beforeEach(() => {
-      state = new newState();
-    });
     it("should create a cbr rule", () => {
-      state.cbr_rules.create({
+      craig.cbr_rules.create({
         name: "cbr-rule",
         description: "description",
         enforcement_mode: "enabled",
@@ -45,10 +44,10 @@ describe("cbr_rules", () => {
           tags: [],
         },
       ];
-      assert.deepEqual(state.store.json.cbr_rules, expectedData);
+      assert.deepEqual(craig.store.json.cbr_rules, expectedData);
     });
     it("should save a cbr rule", () => {
-      state.cbr_rules.create({
+      craig.cbr_rules.create({
         name: "cbr-rule",
         description: "description",
         enforcement_mode: "enabled",
@@ -57,7 +56,7 @@ describe("cbr_rules", () => {
         resource_attributes: [],
         tags: [],
       });
-      state.cbr_rules.save(
+      craig.cbr_rules.save(
         {
           api_type_id: "new",
           description: "hi",
@@ -72,7 +71,7 @@ describe("cbr_rules", () => {
       );
     });
     it("should delete a cbr rule", () => {
-      state.cbr_rules.create({
+      craig.cbr_rules.create({
         name: "cbr-rule",
         description: "description",
         enforcement_mode: "enabled",
@@ -81,7 +80,7 @@ describe("cbr_rules", () => {
         resource_attributes: [],
         tags: [],
       });
-      state.cbr_rules.delete(
+      craig.cbr_rules.delete(
         {},
         {
           data: {
@@ -91,10 +90,8 @@ describe("cbr_rules", () => {
       );
     });
     describe("cbr rules contexts crud", () => {
-      let state;
       beforeEach(() => {
-        state = new newState();
-        state.cbr_rules.create({
+        craig.cbr_rules.create({
           name: "cbr-rule",
           description: "description",
           enforcement_mode: "enabled",
@@ -105,47 +102,47 @@ describe("cbr_rules", () => {
         });
       });
       it("should create a context", () => {
-        state.cbr_rules.contexts.create(
+        craig.cbr_rules.contexts.create(
           { name: "context", value: "blah" },
           {
             innerFormProps: { arrayParentName: "cbr-rule" },
-            arrayData: state.store.json.cbr_rules[0].contexts,
+            arrayData: craig.store.json.cbr_rules[0].contexts,
           }
         );
-        assert.deepEqual(state.store.json.cbr_rules[0].contexts[0], {
+        assert.deepEqual(craig.store.json.cbr_rules[0].contexts[0], {
           name: "context",
           value: "blah",
         });
       });
       it("should update a context", () => {
-        state.cbr_rules.contexts.create(
+        craig.cbr_rules.contexts.create(
           { name: "context", value: "blah" },
           {
             innerFormProps: { arrayParentName: "cbr-rule" },
-            arrayData: state.store.json.cbr_rules[0].contexts,
+            arrayData: craig.store.json.cbr_rules[0].contexts,
           }
         );
-        state.cbr_rules.contexts.save(
+        craig.cbr_rules.contexts.save(
           { name: "context-new", value: "hey" },
           {
             arrayParentName: "cbr-rule",
             data: { name: "context" },
           }
         );
-        assert.deepEqual(state.store.json.cbr_rules[0].contexts[0], {
+        assert.deepEqual(craig.store.json.cbr_rules[0].contexts[0], {
           name: "context-new",
           value: "hey",
         });
       });
       it("should delete a context", () => {
-        state.cbr_rules.contexts.create(
+        craig.cbr_rules.contexts.create(
           { name: "context", value: "blah" },
           {
             innerFormProps: { arrayParentName: "cbr-rule" },
-            arrayData: state.store.json.cbr_rules[0].contexts,
+            arrayData: craig.store.json.cbr_rules[0].contexts,
           }
         );
-        state.cbr_rules.contexts.delete(
+        craig.cbr_rules.contexts.delete(
           {},
           { arrayParentName: "cbr-rule", data: { name: "context" } }
         );
@@ -155,7 +152,7 @@ describe("cbr_rules", () => {
       let state;
       beforeEach(() => {
         state = new newState();
-        state.cbr_rules.create({
+        craig.cbr_rules.create({
           name: "cbr-rule",
           description: "description",
           enforcement_mode: "enabled",
@@ -166,47 +163,47 @@ describe("cbr_rules", () => {
         });
       });
       it("should create an attribute", () => {
-        state.cbr_rules.resource_attributes.create(
+        craig.cbr_rules.resource_attributes.create(
           { name: "attribute", value: "blah" },
           {
             innerFormProps: { arrayParentName: "cbr-rule" },
-            arrayData: state.store.json.cbr_rules[0].resource_attributes,
+            arrayData: craig.store.json.cbr_rules[0].resource_attributes,
           }
         );
-        assert.deepEqual(state.store.json.cbr_rules[0].resource_attributes[0], {
+        assert.deepEqual(craig.store.json.cbr_rules[0].resource_attributes[0], {
           name: "attribute",
           value: "blah",
         });
       });
       it("should update an attribute", () => {
-        state.cbr_rules.resource_attributes.create(
+        craig.cbr_rules.resource_attributes.create(
           { name: "attribute", value: "blah" },
           {
             innerFormProps: { arrayParentName: "cbr-rule" },
-            arrayData: state.store.json.cbr_rules[0].resource_attributes,
+            arrayData: craig.store.json.cbr_rules[0].resource_attributes,
           }
         );
-        state.cbr_rules.resource_attributes.save(
+        craig.cbr_rules.resource_attributes.save(
           { name: "attribute-new", value: "hey" },
           {
             arrayParentName: "cbr-rule",
             data: { name: "attribute" },
           }
         );
-        assert.deepEqual(state.store.json.cbr_rules[0].resource_attributes[0], {
+        assert.deepEqual(craig.store.json.cbr_rules[0].resource_attributes[0], {
           name: "attribute-new",
           value: "hey",
         });
       });
       it("should delete an attribute", () => {
-        state.cbr_rules.resource_attributes.create(
+        craig.cbr_rules.resource_attributes.create(
           { name: "attribute", value: "blah" },
           {
             innerFormProps: { arrayParentName: "cbr-rule" },
-            arrayData: state.store.json.cbr_rules[0].resource_attributes,
+            arrayData: craig.store.json.cbr_rules[0].resource_attributes,
           }
         );
-        state.cbr_rules.resource_attributes.delete(
+        craig.cbr_rules.resource_attributes.delete(
           {},
           { arrayParentName: "cbr-rule", data: { name: "attribute" } }
         );
@@ -216,7 +213,7 @@ describe("cbr_rules", () => {
       let state;
       beforeEach(() => {
         state = new newState();
-        state.cbr_rules.create({
+        craig.cbr_rules.create({
           name: "cbr-rule",
           description: "description",
           enforcement_mode: "enabled",
@@ -227,49 +224,49 @@ describe("cbr_rules", () => {
         });
       });
       it("should create an attribute", () => {
-        state.cbr_rules.tags.create(
+        craig.cbr_rules.tags.create(
           { name: "tag", operator: "op", value: "blah" },
           {
             innerFormProps: { arrayParentName: "cbr-rule" },
-            arrayData: state.store.json.cbr_rules[0].tags,
+            arrayData: craig.store.json.cbr_rules[0].tags,
           }
         );
-        assert.deepEqual(state.store.json.cbr_rules[0].tags[0], {
+        assert.deepEqual(craig.store.json.cbr_rules[0].tags[0], {
           name: "tag",
           operator: "op",
           value: "blah",
         });
       });
       it("should update an attribute", () => {
-        state.cbr_rules.tags.create(
+        craig.cbr_rules.tags.create(
           { name: "tag", operator: "op", value: "blah" },
           {
             innerFormProps: { arrayParentName: "cbr-rule" },
-            arrayData: state.store.json.cbr_rules[0].tags,
+            arrayData: craig.store.json.cbr_rules[0].tags,
           }
         );
-        state.cbr_rules.tags.save(
+        craig.cbr_rules.tags.save(
           { name: "tag-new", operator: "op", value: "blah" },
           {
             arrayParentName: "cbr-rule",
             data: { name: "tag" },
           }
         );
-        assert.deepEqual(state.store.json.cbr_rules[0].tags[0], {
+        assert.deepEqual(craig.store.json.cbr_rules[0].tags[0], {
           name: "tag-new",
           operator: "op",
           value: "blah",
         });
       });
       it("should delete an attribute", () => {
-        state.cbr_rules.tags.create(
+        craig.cbr_rules.tags.create(
           { name: "tag", operator: "op", value: "blah" },
           {
             innerFormProps: { arrayParentName: "cbr-rule" },
-            arrayData: state.store.json.cbr_rules[0].tags,
+            arrayData: craig.store.json.cbr_rules[0].tags,
           }
         );
-        state.cbr_rules.tags.delete(
+        craig.cbr_rules.tags.delete(
           {},
           { arrayParentName: "cbr-rule", data: { name: "tag" } }
         );
@@ -277,147 +274,153 @@ describe("cbr_rules", () => {
     });
     describe("cbr_rules.onStoreUpdate", () => {
       it("should initialize context to empty array", () => {
-        let state = new newState();
-        state.cbr_rules.create({
+        craig.cbr_rules.create({
           name: "cbr-rule",
           description: "description",
           enforcement_mode: "enabled",
           api_type_id: "frog",
         });
-        state.update();
-        assert.deepEqual(state.store.json.cbr_rules[0].tags, []);
+        craig.update();
+        assert.deepEqual(craig.store.json.cbr_rules[0].tags, []);
       });
       it("should make cbr rules empty if undefined", () => {
-        let state = new newState();
-        state.store.json.cbr_rules = undefined;
-        state.update();
-        assert.deepEqual(state.store.json.cbr_rules, []);
+        craig.store.json.cbr_rules = undefined;
+        craig.update();
+        assert.deepEqual(craig.store.json.cbr_rules, []);
       });
     });
   });
   describe("cbr-rules.schema", () => {
     it("should return true when a cbr context with the same name", () => {
-      let actualData = craig.cbr_rules.contexts.name.invalid(
-        {
-          name: "test",
-        },
-        {
-          craig: {
-            store: {
-              json: {
-                cbr_rules: [
-                  {
-                    name: "hi",
-                    contexts: [
-                      {
-                        name: "test",
-                      },
-                      {
-                        name: "frog",
-                      },
-                    ],
-                  },
-                ],
+      assert.isTrue(
+        craig.cbr_rules.contexts.name.invalid(
+          {
+            name: "test",
+          },
+          {
+            craig: {
+              store: {
+                json: {
+                  cbr_rules: [
+                    {
+                      name: "hi",
+                      contexts: [
+                        {
+                          name: "test",
+                        },
+                        {
+                          name: "frog",
+                        },
+                      ],
+                    },
+                  ],
+                },
               },
             },
-          },
-          data: {
-            name: "frog",
-          },
-        }
+            data: {
+              name: "frog",
+            },
+          }
+        ),
+        "it should be true"
       );
-      assert.isTrue(actualData, "it should be true");
     });
     it("should return true when a cbr rule with the same name", () => {
-      let actualData = craig.cbr_rules.name.invalid(
-        {
-          name: "test",
-        },
-        {
-          craig: {
-            store: {
-              json: {
-                cbr_rules: [
-                  {
-                    name: "test",
-                  },
-                  {
-                    name: "frog",
-                  },
-                ],
+      assert.isTrue(
+        craig.cbr_rules.name.invalid(
+          {
+            name: "test",
+          },
+          {
+            craig: {
+              store: {
+                json: {
+                  cbr_rules: [
+                    {
+                      name: "test",
+                    },
+                    {
+                      name: "frog",
+                    },
+                  ],
+                },
               },
             },
-          },
-          data: {
-            name: "frog",
-          },
-        }
+            data: {
+              name: "frog",
+            },
+          }
+        ),
+        "it should be true"
       );
-      assert.isTrue(actualData, "it should be true");
     });
     it("should return true when a cbr resource attribute with the same name", () => {
-      let actualData = craig.cbr_rules.resource_attributes.name.invalid(
-        {
-          name: "test",
-        },
-        {
-          craig: {
-            store: {
-              json: {
-                cbr_rules: [
-                  {
-                    name: "hi",
-                    resource_attributes: [
-                      {
-                        name: "test",
-                      },
-                      {
-                        name: "frog",
-                      },
-                    ],
-                  },
-                ],
+      assert.isTrue(
+        craig.cbr_rules.resource_attributes.name.invalid(
+          {
+            name: "test",
+          },
+          {
+            craig: {
+              store: {
+                json: {
+                  cbr_rules: [
+                    {
+                      name: "hi",
+                      resource_attributes: [
+                        {
+                          name: "test",
+                        },
+                        {
+                          name: "frog",
+                        },
+                      ],
+                    },
+                  ],
+                },
               },
             },
-          },
-          data: {
-            name: "frog",
-          },
-        }
+            data: {
+              name: "frog",
+            },
+          }
+        ),
+        "it should be true"
       );
-      assert.isTrue(actualData, "it should be true");
     });
     it("should return true when a cbr tag with the same name", () => {
-      let actualData = craig.cbr_rules.tags.name.invalid(
-        {
-          name: "test",
-        },
-        {
-          craig: {
-            store: {
-              json: {
-                cbr_rules: [
-                  {
-                    name: "hi",
-                    tags: [
-                      {
-                        name: "test",
-                      },
-                      {
-                        name: "frog",
-                      },
-                    ],
-                  },
-                ],
+      assert.isTrue(
+        craig.cbr_rules.tags.name.invalid(
+          {
+            name: "test",
+          },
+          {
+            craig: {
+              store: {
+                json: {
+                  cbr_rules: [
+                    {
+                      name: "hi",
+                      tags: [
+                        {
+                          name: "test",
+                        },
+                        {
+                          name: "frog",
+                        },
+                      ],
+                    },
+                  ],
+                },
               },
             },
-          },
-          data: {
-            name: "frog",
-          },
-        }
+            data: {
+              name: "frog",
+            },
+          }
+        ),
+        "it should be true"
       );
-      assert.isTrue(actualData, "it should be true");
     });
     it("should return correct groups for enfocement mode", () => {
       assert.deepEqual(
diff --git a/unit-tests/state/key-management.test.js b/unit-tests/state/key-management.test.js
index 27d82591..ac1f00d6 100644
--- a/unit-tests/state/key-management.test.js
+++ b/unit-tests/state/key-management.test.js
@@ -459,6 +459,12 @@ describe("key_management", () => {
       beforeEach(() => {
         craig = newState();
       });
+      it("should not be hidden when use data", () => {
+        assert.isUndefined(
+          craig.key_management.resource_group.hideWhen,
+          "it should be undefined"
+        );
+      });
       it("should not have invalid key ring when empty string", () => {
         assert.isFalse(
           craig.key_management.keys.key_ring.invalid({ key_ring: "" }),
diff --git a/unit-tests/state/routing-tables.test.js b/unit-tests/state/routing-tables.test.js
index 2046b121..edab5fd9 100644
--- a/unit-tests/state/routing-tables.test.js
+++ b/unit-tests/state/routing-tables.test.js
@@ -12,32 +12,22 @@ function newState() {
 }
 
 describe("routing_tables", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("routing_tables.init", () => {
     it("should initialize routing_tables as a list", () => {
-      let state = new newState();
-      let expectedData = [];
       assert.deepEqual(
-        state.store.json.routing_tables,
-        expectedData,
+        craig.store.json.routing_tables,
+        [],
         "it should have routing_tables initialized as a list"
       );
     });
   });
   describe("routing_tables.onStoreUpdate", () => {
     it("should set unfound vpc to null", () => {
-      let state = new newState();
-      let expectedData = {
-        name: "test",
-        vpc: null,
-        routes: [
-          {
-            name: "frog",
-            vpc: null,
-            routing_table: "test",
-          },
-        ],
-      };
-      state.store.json.routing_tables.push({
+      craig.store.json.routing_tables.push({
         name: "test",
         vpc: "bad",
         routes: [
@@ -47,83 +37,73 @@ describe("routing_tables", () => {
           },
         ],
       });
-      state.update();
+      craig.update();
       assert.deepEqual(
-        state.store.json.routing_tables[0],
-        expectedData,
+        craig.store.json.routing_tables[0].vpc,
+        null,
+        "it should return correct data"
+      );
+      assert.deepEqual(
+        craig.store.json.routing_tables[0].routes[0].vpc,
+        null,
         "it should return correct data"
       );
     });
   });
   describe("routing_tables.save", () => {
     it("should change the properties of the routing table instance", () => {
-      let state = new newState();
-      state.routing_tables.create({
+      craig.routing_tables.create({
         name: "kms",
         vpc: "management",
       });
-      state.routing_tables.save(
+      craig.routing_tables.save(
         {
           name: "todd",
           vpc: "management",
         },
         { data: { name: "kms" } }
       );
-      let expectedData = [
-        {
-          name: "todd",
-          vpc: "management",
-          routes: [],
-        },
-      ];
       assert.deepEqual(
-        state.store.json.routing_tables,
-        expectedData,
+        craig.store.json.routing_tables[0].name,
+        "todd",
         "it should update everything"
       );
     });
   });
   describe("routing_tables.create", () => {
     it("should add a new routing table system", () => {
-      let state = new newState();
-      let expectedData = [
-        {
-          name: "todd",
-          vpc: null,
-          routes: [],
-        },
-      ];
-      state.routing_tables.create({
+      craig.routing_tables.create({
         name: "todd",
         vpc: "frog",
       });
       assert.deepEqual(
-        state.store.json.routing_tables,
-        expectedData,
+        craig.store.json.routing_tables,
+        [
+          {
+            name: "todd",
+            vpc: null,
+            routes: [],
+          },
+        ],
         "it should return correct data"
       );
     });
   });
   describe("routing_tables.delete", () => {
     it("should delete a routing_tables system", () => {
-      let state = new newState();
-      state.routing_tables.create({
+      craig.routing_tables.create({
         name: "kms",
         vpc: "management",
       });
-      state.routing_tables.delete({}, { data: { name: "kms" } });
+      craig.routing_tables.delete({}, { data: { name: "kms" } });
       assert.deepEqual(
-        state.store.json.routing_tables,
+        craig.store.json.routing_tables,
         [],
         "it should return correct data"
       );
     });
   });
   describe("routing tables schema", () => {
-    let craig;
-    beforeEach(() => {
-      craig = newState();
-    });
     it("should return list of routes on render", () => {
       assert.deepEqual(
         craig.routing_tables.accept_routes_from_resource_type.onRender({
@@ -144,14 +124,15 @@ describe("routing_tables", () => {
     });
   });
   describe("routing_tables.routes", () => {
+    beforeEach(() => {
+      craig.routing_tables.create({
+        name: "frog",
+        vpc: "management",
+      });
+    });
     describe("routing_tables.routes.create", () => {
       it("should create a new route", () => {
-        let state = new newState();
-        state.routing_tables.create({
-          name: "frog",
-          vpc: "management",
-        });
-        state.routing_tables.routes.create(
+        craig.routing_tables.routes.create(
           {
             name: "test-route",
             zone: 1,
@@ -160,7 +141,7 @@ describe("routing_tables", () => {
           },
           {
             innerFormProps: { arrayParentName: "frog" },
-            arrayData: state.store.json.routing_tables[0].routes,
+            arrayData: craig.store.json.routing_tables[0].routes,
           }
         );
         let expectedData = {
@@ -172,7 +153,7 @@ describe("routing_tables", () => {
           action: "delegate",
         };
         assert.deepEqual(
-          state.store.json.routing_tables[0].routes[0],
+          craig.store.json.routing_tables[0].routes[0],
           expectedData,
           "it should add route"
         );
@@ -180,13 +161,7 @@ describe("routing_tables", () => {
     });
     describe("routing_tables.routes.save", () => {
       it("should update an encryption key in place", () => {
-        let state = new newState();
-        state.routing_tables.create({
-          name: "frog",
-          vpc: "management",
-          routes: [],
-        });
-        state.routing_tables.routes.create(
+        craig.routing_tables.routes.create(
           {
             routing_table: "frog",
             name: "test-route",
@@ -196,10 +171,10 @@ describe("routing_tables", () => {
           },
           {
             innerFormProps: { arrayParentName: "frog" },
-            arrayData: state.store.json.routing_tables[0].routes,
+            arrayData: craig.store.json.routing_tables[0].routes,
           }
         );
-        state.routing_tables.routes.save(
+        craig.routing_tables.routes.save(
           {
             name: "aaaaa",
           },
@@ -214,7 +189,7 @@ describe("routing_tables", () => {
           action: "delegate",
         };
         assert.deepEqual(
-          state.store.json.routing_tables[0].routes[0],
+          craig.store.json.routing_tables[0].routes[0],
           expectedData,
           "it should update key"
         );
@@ -222,12 +197,7 @@ describe("routing_tables", () => {
     });
     describe("routing_tables.routes.delete", () => {
       it("should delete an encryption key", () => {
-        let state = new newState();
-        state.routing_tables.create({
-          name: "frog",
-          vpc: "management",
-        });
-        state.routing_tables.routes.create(
+        craig.routing_tables.routes.create(
           {
             name: "test-route",
             zone: 1,
@@ -236,25 +206,21 @@ describe("routing_tables", () => {
           },
           {
             innerFormProps: { arrayParentName: "frog" },
-            arrayData: state.store.json.routing_tables[0].routes,
+            arrayData: craig.store.json.routing_tables[0].routes,
           }
         );
-        state.routing_tables.routes.delete(
+        craig.routing_tables.routes.delete(
           {},
           { arrayParentName: "frog", data: { name: "test-route" } }
         );
         assert.deepEqual(
-          state.store.json.routing_tables[0].routes,
+          craig.store.json.routing_tables[0].routes,
           [],
           "it should update data"
         );
       });
     });
     describe("routing tables route schema", () => {
-      let craig;
-      beforeEach(() => {
-        craig = newState();
-      });
       it("should return correct action on render when not set", () => {
         assert.deepEqual(
           craig.routing_tables.routes.action.onRender({}),
diff --git a/unit-tests/state/sccV2.test.js b/unit-tests/state/sccV2.test.js
index 48c6447d..726ed9bb 100644
--- a/unit-tests/state/sccV2.test.js
+++ b/unit-tests/state/sccV2.test.js
@@ -92,7 +92,6 @@ describe("scc_v2", () => {
   });
   describe("scc_v2.profile_attachments", () => {
     beforeEach(() => {
-      craig = newState();
       craig.scc_v2.save({
         enable: true,
         region: "eu-de",
diff --git a/unit-tests/state/secrets-manager.test.js b/unit-tests/state/secrets-manager.test.js
index 14339181..3af6b716 100644
--- a/unit-tests/state/secrets-manager.test.js
+++ b/unit-tests/state/secrets-manager.test.js
@@ -12,26 +12,24 @@ function newState() {
 }
 
 describe("secrets_manager", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("secrets_manager.init", () => {
     it("should initialize secrets_manager", () => {
-      let state = new newState();
-      let expectedData = [];
       assert.deepEqual(
-        state.store.json.secrets_manager,
-        expectedData,
+        craig.store.json.secrets_manager,
+        [],
         "it should have secrets_manager initialized"
       );
     });
   });
   describe("secrets_manager crud functions", () => {
-    let secrets_managerState;
-    beforeEach(() => {
-      secrets_managerState = new newState();
-    });
     it("should add an secrets_manager instance", () => {
-      secrets_managerState.secrets_manager.create({ name: "default" });
+      craig.secrets_manager.create({ name: "default" });
       assert.deepEqual(
-        secrets_managerState.store.json.secrets_manager,
+        craig.store.json.secrets_manager,
         [
           {
             name: "default",
@@ -45,120 +43,101 @@ describe("secrets_manager", () => {
       );
     });
     it("should save an secrets_manager instance", () => {
-      secrets_managerState.secrets_manager.create({
+      craig.secrets_manager.create({
         name: "default",
         encryption_key: "key",
       });
-      secrets_managerState.secrets_manager.save(
+      craig.secrets_manager.save(
         { resource_group: "service-rg" },
         { data: { name: "default" } }
       );
       assert.deepEqual(
-        secrets_managerState.store.json.secrets_manager,
-        [
-          {
-            name: "default",
-            resource_group: "service-rg",
-            encryption_key: "key",
-            kms: "kms",
-            secrets: [],
-          },
-        ],
+        craig.store.json.secrets_manager[0].resource_group,
+        "service-rg",
         "it should create secrets_manager"
       );
     });
     it("should update cluster.opaque_secrets.secret_manager name when secrets manager is renamed", () => {
-      let state = new newState();
-      state.store.json.clusters[0].opaque_secrets[0] = {
+      craig.store.json.clusters[0].opaque_secrets[0] = {
         name: "test",
         secrets_manager: "default",
       };
-      state.secrets_manager.create({
+      craig.secrets_manager.create({
         name: "default",
         encryption_key: "key",
       });
-      state.secrets_manager.save(
+      craig.secrets_manager.save(
         { name: "new-name" },
         { data: { name: "default" } }
       );
       assert.deepEqual(
-        state.store.json.clusters[0].opaque_secrets[0].secrets_manager,
+        craig.store.json.clusters[0].opaque_secrets[0].secrets_manager,
         "new-name",
         "it should update cluster.opaque_secrets"
       );
     });
     it("should not update cluster.opaque_secrets.secret_manager name when unrelated secrets manager is renamed", () => {
-      let state = new newState();
-      state.store.json.clusters[0].opaque_secrets[0] = {
+      craig.store.json.clusters[0].opaque_secrets[0] = {
         name: "test",
         secrets_manager: "frog",
       };
-      state.secrets_manager.create({
+      craig.secrets_manager.create({
         name: "default",
         encryption_key: "key",
       });
-      state.secrets_manager.save(
+      craig.secrets_manager.save(
         { name: "new-name" },
         { data: { name: "default" } }
       );
       assert.deepEqual(
-        state.store.json.clusters[0].opaque_secrets[0].secrets_manager,
+        craig.store.json.clusters[0].opaque_secrets[0].secrets_manager,
         "frog",
         "it should not update cluster.opaque_secrets"
       );
     });
     it("should not update cluster.opaque_secrets.secret_manager when no opaque secrets", () => {
-      let state = new newState();
-      delete state.store.json.clusters[0].opaque_secrets;
-      state.secrets_manager.create({
+      delete craig.store.json.clusters[0].opaque_secrets;
+      craig.secrets_manager.create({
         name: "default",
         encryption_key: "key",
       });
-      state.secrets_manager.save(
+      craig.secrets_manager.save(
         { name: "new-name" },
         { data: { name: "default" } }
       );
       assert.deepEqual(
-        state.store.json.clusters[0].opaque_secrets,
+        craig.store.json.clusters[0].opaque_secrets,
         [],
         "it should update cluster.opaque_secrets"
       );
     });
     it("should not update empty cluster secrets when secrets manager updates", () => {
-      let state = new newState();
-      state.store.json.clusters[0].opaque_secrets = [];
-      state.secrets_manager.create({
+      craig.store.json.clusters[0].opaque_secrets = [];
+      craig.secrets_manager.create({
         name: "new-secret-manager",
         encryption_key: "key",
       });
-      state.secrets_manager.save(
+      craig.secrets_manager.save(
         { name: "updated-name" },
         { data: { name: "new-secret-manager" } }
       );
       assert.deepEqual(
-        state.store.json.clusters[0].opaque_secrets,
+        craig.store.json.clusters[0].opaque_secrets,
         [],
         "it should not update cluster.opaque_secrets"
       );
     });
     it("should delete an secrets_manager instance", () => {
-      secrets_managerState.secrets_manager.create({ name: "default" });
-      secrets_managerState.secrets_manager.delete(
-        {},
-        { data: { name: "default" } }
-      );
+      craig.secrets_manager.create({ name: "default" });
+      craig.secrets_manager.delete({}, { data: { name: "default" } });
       assert.deepEqual(
-        secrets_managerState.store.json.secrets_manager,
+        craig.store.json.secrets_manager,
         [],
         "it should create secrets_manager"
       );
     });
   });
   describe("schema", () => {
-    let craig;
-    beforeEach(() => {
-      craig = newState();
-    });
     describe("name", () => {
       it("should return true if a secrets manager instance has an invalid name", () => {
         assert.isTrue(
diff --git a/unit-tests/state/security-groups.test.js b/unit-tests/state/security-groups.test.js
index ff88f4a0..bd1d62ca 100644
--- a/unit-tests/state/security-groups.test.js
+++ b/unit-tests/state/security-groups.test.js
@@ -23,9 +23,12 @@ function lazyAddSg(slz) {
 }
 
 describe("security groups", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("security_groups.init", () => {
     it("should initialize security groups", () => {
-      let store = newState();
       let expectedData = [
         {
           vpc: "management",
@@ -481,9 +484,9 @@ describe("security groups", () => {
           ],
         },
       ];
-      store.update();
+      craig.update();
       assert.deepEqual(
-        store.store.json.security_groups,
+        craig.store.json.security_groups,
         expectedData,
         "it should return default security groups"
       );
@@ -491,40 +494,36 @@ describe("security groups", () => {
   });
   describe("security_groups.onStoreUpdate", () => {
     it("should set securityGroups on update", () => {
-      let slz = new newState();
-      slz.update();
+      craig.update();
       assert.deepEqual(
         {
           management: ["management-vpe", "management-vsi"],
           workload: ["workload-vpe"],
         },
-        slz.store.securityGroups,
+        craig.store.securityGroups,
         "it should add groups"
       );
     });
     it("should set vpc name to null when a vpc a security group is attached to is deleted", () => {
-      let slz = new newState();
-      slz.vpcs.delete({}, { data: { name: "management" } });
+      craig.vpcs.delete({}, { data: { name: "management" } });
       assert.deepEqual(
-        slz.store.json.security_groups[0].vpc,
+        craig.store.json.security_groups[0].vpc,
         null,
         "it should set to null"
       );
     });
     it("should set vpc name in a security group rule to null when a vpc a security group is attached to is deleted", () => {
-      let slz = new newState();
-      slz.vpcs.delete({}, { data: { name: "management" } });
+      craig.vpcs.delete({}, { data: { name: "management" } });
       assert.deepEqual(
-        slz.store.json.security_groups[0].rules[0].vpc,
+        craig.store.json.security_groups[0].rules[0].vpc,
         null,
         "it should set to null"
       );
     });
     it("should set resource group to null when a resource group a security group is attached to is deleted", () => {
-      let slz = new newState();
-      slz.resource_groups.delete({}, { data: { name: "management-rg" } });
+      craig.resource_groups.delete({}, { data: { name: "management-rg" } });
       assert.deepEqual(
-        slz.store.json.security_groups[0].resource_group,
+        craig.store.json.security_groups[0].resource_group,
         null,
         "it should set to null"
       );
@@ -532,15 +531,14 @@ describe("security groups", () => {
   });
   describe("security_groups.create", () => {
     it("should create a new security group", () => {
-      let slz = new newState();
-      slz.security_groups.create({
+      craig.security_groups.create({
         name: "frog",
         vpc: "management",
         resource_group: null,
         rules: [],
       });
       assert.deepEqual(
-        slz.store.json.security_groups[3],
+        craig.store.json.security_groups[3],
         {
           name: "frog",
           vpc: "management",
@@ -553,32 +551,29 @@ describe("security groups", () => {
   });
   describe("security_groups.save", () => {
     it("should update a security group", () => {
-      let slz = new newState();
-      slz.security_groups.save(
+      craig.security_groups.save(
         { name: "todd" },
         { data: { name: "management-vpe", rules: [] } }
       );
       assert.deepEqual(
-        slz.store.json.security_groups[0].name,
+        craig.store.json.security_groups[0].name,
         "todd",
         "it should update the group"
       );
     });
     it("should update a security group with same name", () => {
-      let slz = new newState();
-      slz.security_groups.save(
+      craig.security_groups.save(
         { name: "management-vpe" },
         { data: { name: "management-vpe", rules: [] } }
       );
       assert.deepEqual(
-        slz.store.json.security_groups[0].name,
+        craig.store.json.security_groups[0].name,
         "management-vpe",
         "it should update the group"
       );
     });
     it("should update a security group with a new vpc and sg name", () => {
-      let slz = new newState();
-      slz.security_groups.save(
+      craig.security_groups.save(
         { name: "todd", vpc: "workload" },
         {
           data: {
@@ -597,12 +592,12 @@ describe("security groups", () => {
         }
       );
       assert.deepEqual(
-        slz.store.json.security_groups[0].rules[0].vpc,
+        craig.store.json.security_groups[0].rules[0].vpc,
         "workload",
         "it should update the group"
       );
       assert.deepEqual(
-        slz.store.json.security_groups[0].rules[0].sg,
+        craig.store.json.security_groups[0].rules[0].sg,
         "todd",
         "it should update the group"
       );
@@ -610,20 +605,15 @@ describe("security groups", () => {
   });
   describe("security_groups.delete", () => {
     it("should delete a security group", () => {
-      let slz = new newState();
-      slz.security_groups.delete({}, { data: { name: "management-vpe" } });
+      craig.security_groups.delete({}, { data: { name: "management-vpe" } });
       assert.deepEqual(
-        slz.store.json.security_groups.length,
+        craig.store.json.security_groups.length,
         2,
         "it should delete the group"
       );
     });
   });
   describe("security_groups.schema", () => {
-    let craig;
-    beforeEach(() => {
-      craig = newState();
-    });
     it("should hide use_data", () => {
       assert.isTrue(
         craig.security_groups.use_data.hideWhen({}, { craig: craig }),
@@ -662,9 +652,8 @@ describe("security groups", () => {
   describe("security_group.rules", () => {
     describe("security_groups.rules.create", () => {
       it("should add a new rule", () => {
-        let slz = new newState();
-        lazyAddSg(slz);
-        slz.security_groups.rules.create(
+        lazyAddSg(craig);
+        craig.security_groups.rules.create(
           {
             name: "test-rule",
             source: "8.8.8.8",
@@ -673,7 +662,7 @@ describe("security groups", () => {
           { parent_name: "frog" }
         );
         assert.deepEqual(
-          slz.store.json.security_groups[3].rules,
+          craig.store.json.security_groups[3].rules,
           [
             {
               sg: "frog",
@@ -697,16 +686,15 @@ describe("security groups", () => {
     });
     describe("security_groups.rules.save", () => {
       it("should update a rule in place", () => {
-        let slz = new newState();
-        lazyAddSg(slz);
-        slz.security_groups.rules.create(
+        lazyAddSg(craig);
+        craig.security_groups.rules.create(
           {
             name: "test-rule",
             source: "8.8.8.8",
           },
           { parent_name: "frog" }
         );
-        slz.security_groups.rules.save(
+        craig.security_groups.rules.save(
           {
             inbound: true,
             name: "test-rule",
@@ -718,31 +706,14 @@ describe("security groups", () => {
           }
         );
         assert.deepEqual(
-          slz.store.json.security_groups[3].rules,
-          [
-            {
-              name: "test-rule",
-              direction: "inbound",
-              icmp: { type: null, code: null },
-              tcp: { port_min: null, port_max: null },
-              udp: { port_min: null, port_max: null },
-              source: "8.8.8.8",
-              sg: "frog",
-              vpc: "management",
-              port_max: null,
-              port_min: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-          ],
+          craig.store.json.security_groups[3].rules[0].direction,
+          "inbound",
           "it should update rule"
         );
       });
       it("should update a rule in place with protocol", () => {
-        let slz = new newState();
-        lazyAddSg(slz);
-        slz.security_groups.rules.create(
+        lazyAddSg(craig);
+        craig.security_groups.rules.create(
           {
             name: "test-rule",
             source: "8.8.8.8",
@@ -770,7 +741,7 @@ describe("security groups", () => {
             parent_name: "frog",
           }
         );
-        slz.security_groups.rules.save(
+        craig.security_groups.rules.save(
           {
             name: "test-rule",
             inbound: true,
@@ -801,7 +772,7 @@ describe("security groups", () => {
           }
         );
         assert.deepEqual(
-          slz.store.json.security_groups[3].rules,
+          craig.store.json.security_groups[3].rules,
           [
             {
               name: "test-rule",
@@ -823,9 +794,8 @@ describe("security groups", () => {
         );
       });
       it("should update a rule in place with icmp protocol", () => {
-        let slz = new newState();
-        lazyAddSg(slz);
-        slz.security_groups.rules.create(
+        lazyAddSg(craig);
+        craig.security_groups.rules.create(
           {
             name: "test-rule",
             source: "8.8.8.8",
@@ -846,7 +816,7 @@ describe("security groups", () => {
             parent_name: "frog",
           }
         );
-        slz.security_groups.rules.save(
+        craig.security_groups.rules.save(
           {
             name: "test-rule",
             inbound: true,
@@ -871,7 +841,7 @@ describe("security groups", () => {
           }
         );
         assert.deepEqual(
-          slz.store.json.security_groups[3].rules,
+          craig.store.json.security_groups[3].rules,
           [
             {
               name: "test-rule",
@@ -893,9 +863,8 @@ describe("security groups", () => {
         );
       });
       it("should update a rule in place with icmp protocol", () => {
-        let slz = new newState();
-        lazyAddSg(slz);
-        slz.security_groups.rules.create(
+        lazyAddSg(craig);
+        craig.security_groups.rules.create(
           {
             name: "test-rule",
             source: "8.8.8.8",
@@ -916,7 +885,7 @@ describe("security groups", () => {
             parent_name: "frog",
           }
         );
-        slz.security_groups.rules.save(
+        craig.security_groups.rules.save(
           {
             name: "test-rule",
             inbound: true,
@@ -935,7 +904,7 @@ describe("security groups", () => {
           }
         );
         assert.deepEqual(
-          slz.store.json.security_groups[3].rules,
+          craig.store.json.security_groups[3].rules,
           [
             {
               name: "test-rule",
@@ -957,16 +926,15 @@ describe("security groups", () => {
         );
       });
       it("should update a rule in place with all protocol", () => {
-        let slz = new newState();
-        lazyAddSg(slz);
-        slz.security_groups.rules.create(
+        lazyAddSg(craig);
+        craig.security_groups.rules.create(
           {
             name: "test-rule",
             source: "8.8.8.8",
           },
           { parent_name: "frog" }
         );
-        slz.security_groups.rules.save(
+        craig.security_groups.rules.save(
           {
             inbound: true,
             ruleProtocol: "all",
@@ -979,7 +947,7 @@ describe("security groups", () => {
           }
         );
         assert.deepEqual(
-          slz.store.json.security_groups[3].rules,
+          craig.store.json.security_groups[3].rules,
           [
             {
               name: "test-rule",
@@ -1003,9 +971,8 @@ describe("security groups", () => {
     });
     describe("security_groups.rules.delete", () => {
       it("should delete a rule", () => {
-        let slz = new newState();
-        lazyAddSg(slz);
-        slz.security_groups.rules.create(
+        lazyAddSg(craig);
+        craig.security_groups.rules.create(
           {
             name: "test-rule",
             source: "8.8.8.8",
@@ -1014,7 +981,7 @@ describe("security groups", () => {
             parent_name: "frog",
           }
         );
-        slz.security_groups.rules.delete(
+        craig.security_groups.rules.delete(
           {},
           {
             parent_name: "frog",
@@ -1022,14 +989,13 @@ describe("security groups", () => {
           }
         );
         assert.deepEqual(
-          slz.store.json.security_groups[3].rules,
+          craig.store.json.security_groups[3].rules,
           [],
           "it should delete rule"
         );
       });
     });
     describe("security_groups.rules.schema", () => {
-      let craig = new newState();
       it("should set data when changing rule protocol", () => {
         let data = { ruleProtocol: "all" };
         craig.security_groups.rules.ruleProtocol.onInputChange(data);
diff --git a/unit-tests/state/ssh-keys.test.js b/unit-tests/state/ssh-keys.test.js
index 64489409..ff1920c8 100644
--- a/unit-tests/state/ssh-keys.test.js
+++ b/unit-tests/state/ssh-keys.test.js
@@ -12,10 +12,13 @@ function newState() {
 }
 
 describe("ssh_keys", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("ssh_keys.init", () => {
     it("should initialize with default ssh key if pattern has vsi", () => {
-      let state = new newState();
-      assert.deepEqual(state.store.json.ssh_keys, [
+      assert.deepEqual(craig.store.json.ssh_keys, [
         {
           name: "ssh-key",
           public_key: "<user-determined-value>",
@@ -27,90 +30,77 @@ describe("ssh_keys", () => {
   });
   describe("ssh_keys.delete", () => {
     it("should delete an unused ssh key and update list", () => {
-      let state = new newState();
-      state.ssh_keys.delete({}, { data: { name: "ssh-key" } });
+      craig.ssh_keys.delete({}, { data: { name: "ssh-key" } });
       assert.deepEqual(
-        state.store.json.ssh_keys,
+        craig.store.json.ssh_keys,
         [],
         "there should be no keys"
       );
-      assert.deepEqual(state.store.sshKeys, [], "it should remove the ssh key");
+      assert.deepEqual(craig.store.sshKeys, [], "it should remove the ssh key");
     });
   });
   describe("ssh_keys.save", () => {
     it("should update an ssh key in place", () => {
-      let state = new newState();
-      state.ssh_keys.save(
+      craig.ssh_keys.save(
         { name: "todd", show: false },
         { data: { name: "ssh-key" } }
       );
-      assert.deepEqual(state.store.sshKeys, ["todd"], "it should be todd");
+      assert.deepEqual(craig.store.sshKeys, ["todd"], "it should be todd");
       assert.deepEqual(
-        state.store.json.ssh_keys[0].name,
+        craig.store.json.ssh_keys[0].name,
         "todd",
         "it should have a new name"
       );
     });
     it("should update an ssh key in place with same name", () => {
-      let state = new newState();
       // for vsi test, dummy vsi
-      state.store.json.vsi = [{ ssh_keys: ["ssh-key"] }];
-      state.ssh_keys.save(
+      craig.store.json.vsi = [{ ssh_keys: ["ssh-key"] }];
+      craig.ssh_keys.save(
         { name: "ssh-key", public_key: "todd" },
         { data: { name: "ssh-key" } }
       );
       assert.deepEqual(
-        state.store.json.ssh_keys[0].public_key,
+        craig.store.json.ssh_keys[0].public_key,
         "todd",
         "it should have a new public key"
       );
     });
     it("should update an ssh key in place with same name not used by vsi", () => {
-      let state = new newState();
-      state.ssh_keys.create({ name: "frog" });
-      state.ssh_keys.save({ name: "todd" }, { data: { name: "frog" } });
+      craig.ssh_keys.create({ name: "frog" });
+      craig.ssh_keys.save({ name: "todd" }, { data: { name: "frog" } });
       assert.deepEqual(
-        state.store.sshKeys,
+        craig.store.sshKeys,
         ["ssh-key", "todd"],
         "it should have a new name"
       );
     });
     it("should update vsi ssh key name", () => {
-      let state = new newState();
       // for vsi test, dummy vsi
-      state.store.json.vsi = [{ ssh_keys: ["ssh-key"] }];
-      state.ssh_keys.save({ name: "frog" }, { data: { name: "ssh-key" } });
+      craig.store.json.vsi = [{ ssh_keys: ["ssh-key"] }];
+      craig.ssh_keys.save({ name: "frog" }, { data: { name: "ssh-key" } });
       assert.deepEqual(
-        state.store.json.vsi[0].ssh_keys,
+        craig.store.json.vsi[0].ssh_keys,
         ["frog"],
         "it should have a new ssh key"
       );
     });
   });
   it("should set public key to null when using data", () => {
-    let state = new newState();
-    let expectedData = {
-      name: "todd",
-      use_data: true,
-      resource_group: "management-rg",
-      public_key: null,
-    };
-    state.ssh_keys.save(
+    craig.ssh_keys.save(
       { name: "todd", use_data: true, public_key: "honk" },
       { data: { name: "ssh-key" } }
     );
     assert.deepEqual(
-      state.store.json.ssh_keys[0],
-      expectedData,
+      craig.store.json.ssh_keys[0].public_key,
+      null,
       "it should have a new name and public key null"
     );
   });
   describe("ssh_keys.create", () => {
     it("should create a new ssh key", () => {
-      let state = new newState();
-      state.ssh_keys.create({ name: "frog" });
+      craig.ssh_keys.create({ name: "frog" });
       assert.deepEqual(
-        state.store.sshKeys,
+        craig.store.sshKeys,
         ["ssh-key", "frog"],
         "it should have a new name"
       );
@@ -119,7 +109,6 @@ describe("ssh_keys", () => {
   describe("ssh_keys.schema", () => {
     describe("public_key", () => {
       it("should not be invalid if the key is NONE and another NONE key exists", () => {
-        let craig = newState();
         craig.store.json.ssh_keys.push({ name: "test", public_key: "NONE" });
         assert.isFalse(
           craig.ssh_keys.public_key.invalid(
@@ -135,7 +124,6 @@ describe("ssh_keys", () => {
       });
       describe("hideWhen", () => {
         it("should return true when use data is true", () => {
-          let craig = newState();
           assert.isTrue(
             craig.ssh_keys.public_key.hideWhen({ use_data: true }),
             "it should be true"
diff --git a/unit-tests/state/state.test.js b/unit-tests/state/state.test.js
index 1f859b49..97abd955 100644
--- a/unit-tests/state/state.test.js
+++ b/unit-tests/state/state.test.js
@@ -17,29 +17,30 @@ function newState() {
 }
 
 describe("state util functions", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("setStoreValue", () => {
     it("should set a store value", () => {
-      let state = newState();
-      state.setStoreValue("jsonInCodeMirror", true);
-      assert.isTrue(state.store.jsonInCodeMirror, "it should be set");
+      craig.setStoreValue("jsonInCodeMirror", true);
+      assert.isTrue(craig.store.jsonInCodeMirror, "it should be set");
     });
   });
   describe("toggleStoreValue", () => {
     it("should toggle a boolean store value", () => {
-      let state = newState();
-      state.toggleStoreValue("hideCodeMirror");
-      assert.isTrue(state.store.hideCodeMirror, "it should toggle value");
+      craig.toggleStoreValue("hideCodeMirror");
+      assert.isTrue(craig.store.hideCodeMirror, "it should toggle value");
     });
   });
   describe("addClusterRules", () => {
     it("should add rules and skip duplicate rules", () => {
-      let state = newState();
-      state.store.json.vpcs[0].acls[0].rules.push({
+      craig.store.json.vpcs[0].acls[0].rules.push({
         name: "roks-create-worker-nodes-inbound",
       });
-      state.addClusterRules("management", "management");
+      craig.addClusterRules("management", "management");
       assert.deepEqual(
-        splat(state.store.json.vpcs[0].acls[0].rules, "name"),
+        splat(craig.store.json.vpcs[0].acls[0].rules, "name"),
         [
           "allow-ibm-inbound",
           "allow-ibm-outbound",
@@ -60,11 +61,10 @@ describe("state util functions", () => {
   });
   describe("copySecurityGroup", () => {
     it("should copy acl from one vpc to another", () => {
-      let state = newState();
-      state.store.json.vpcs[1].acls = [];
-      state.copySecurityGroup("management-vpe", "workload");
+      craig.store.json.vpcs[1].acls = [];
+      craig.copySecurityGroup("management-vpe", "workload");
       assert.deepEqual(
-        splat(state.store.json.security_groups, "name")[3],
+        splat(craig.store.json.security_groups, "name")[3],
         "management-vpe-copy",
         "it should copy"
       );
@@ -72,11 +72,10 @@ describe("state util functions", () => {
   });
   describe("copyNetworkAcl", () => {
     it("should copy acl from one vpc to another", () => {
-      let state = newState();
-      state.store.json.vpcs[1].acls = [];
-      state.copyNetworkAcl("management", "management", "workload");
+      craig.store.json.vpcs[1].acls = [];
+      craig.copyNetworkAcl("management", "management", "workload");
       assert.deepEqual(
-        splat(state.store.json.vpcs[1].acls, "name"),
+        splat(craig.store.json.vpcs[1].acls, "name"),
         ["management-copy"],
         "it should copy"
       );
@@ -84,16 +83,15 @@ describe("state util functions", () => {
   });
   describe("copyRule", () => {
     it("should copy one rule from vpc to another", () => {
-      let state = newState();
-      state.store.json.vpcs[1].acls[0].rules = [];
-      state.copyRule(
+      craig.store.json.vpcs[1].acls[0].rules = [];
+      craig.copyRule(
         "management",
         "management",
         "allow-all-network-outbound",
         "workload"
       );
       assert.deepEqual(
-        splat(state.store.json.vpcs[1].acls[0].rules, "name"),
+        splat(craig.store.json.vpcs[1].acls[0].rules, "name"),
         ["allow-all-network-outbound"],
         "it should copy"
       );
@@ -101,11 +99,10 @@ describe("state util functions", () => {
   });
   describe("copySgRule", () => {
     it("should copy one rule from sg to another", () => {
-      let state = newState();
-      state.store.json.security_groups[0].rules = [];
-      state.copySgRule("workload-vpe", "allow-vpc-outbound", "management-vpe");
+      craig.store.json.security_groups[0].rules = [];
+      craig.copySgRule("workload-vpe", "allow-vpc-outbound", "management-vpe");
       assert.deepEqual(
-        splat(state.store.json.security_groups[0].rules, "name"),
+        splat(craig.store.json.security_groups[0].rules, "name"),
         ["allow-vpc-outbound"],
         "it should copy"
       );
@@ -245,8 +242,8 @@ describe("state util functions", () => {
           has_prefix: false,
         },
       ];
-      let state = new newState(true);
-      let actualData = state.getAllSubnets();
+      craig = new newState(true);
+      let actualData = craig.getAllSubnets();
       assert.deepEqual(
         actualData,
         expectedData,
@@ -256,20 +253,19 @@ describe("state util functions", () => {
   });
   describe("hardSetJson", () => {
     it("should set JSON data if valid", () => {
-      let state = newState();
-      state.store = {
+      craig.store = {
         json: {},
       };
-      state.setUpdateCallback(() => {});
+      craig.setUpdateCallback(() => {});
       delete json.ssh_keys[1]; // remove extra ssh key that should not be there lol
-      state.hardSetJson({ ...json });
+      craig.hardSetJson({ ...json });
       assert.deepEqual(
-        state.store.json,
+        craig.store.json,
         { ...hardSetData },
         "it should set the store"
       );
       assert.deepEqual(
-        state.store.subnetTiers,
+        craig.store.subnetTiers,
         {
           management: [
             { name: "vsi", zones: 3 },
@@ -285,9 +281,8 @@ describe("state util functions", () => {
       );
     });
     it("should set JSON data if valid with routing tables", () => {
-      let state = newState();
       let rtJson = require("../data-files/craig-json-routing-tables.json");
-      state.setUpdateCallback(() => {});
+      craig.setUpdateCallback(() => {});
       delete json.ssh_keys[1]; // remove extra ssh key that should not be there lol
       let expectedData = { ...hardSetData };
       expectedData.routing_tables = [
@@ -302,14 +297,14 @@ describe("state util functions", () => {
           vpc: "management",
         },
       ];
-      state.hardSetJson(rtJson);
+      craig.hardSetJson(rtJson);
       assert.deepEqual(
-        state.store.json,
+        craig.store.json,
         expectedData,
         "it should set the store"
       );
       assert.deepEqual(
-        state.store.subnetTiers,
+        craig.store.subnetTiers,
         {
           management: [
             { name: "vsi", zones: 3 },
@@ -325,7 +320,6 @@ describe("state util functions", () => {
       );
     });
     it("should hard set json data and set edge pattern when edge resources are found", () => {
-      let state = newState();
       let data = {
         _options: {
           craig_version: "1.12.0",
@@ -2590,34 +2584,32 @@ describe("state util functions", () => {
         classic_ssh_keys: [],
         classic_vlans: [],
       };
-      state.setUpdateCallback(() => {});
       delete data.ssh_keys[0]; // remove extra ssh key that should not be there lol
-      state.hardSetJson(data);
+      craig.hardSetJson(data);
       assert.deepEqual(
-        state.store.edge_vpc_name,
+        craig.store.edge_vpc_name,
         "edge",
         "it should update name"
       );
       assert.deepEqual(
-        state.store.edge_zones,
+        craig.store.edge_zones,
         3,
         "it should set correct number of zones"
       );
     });
     it("should set JSON data if valid with advanced subnet tiers", () => {
-      let state = newState();
       let data = require("../data-files/craig-json.json");
       data.vpcs[0].subnets.forEach((subnet) => {
         if (subnet.name.indexOf("vsi-zone") !== -1) {
           subnet.tier = "frog";
         }
       });
-      state.setUpdateCallback(() => {});
+      craig.setUpdateCallback(() => {});
       delete json.ssh_keys[1]; // remove extra ssh key that should not be there lol
-      state.hardSetJson(data);
-      assert.deepEqual(state.store.json, data, "it should set the store");
+      craig.hardSetJson(data);
+      assert.deepEqual(craig.store.json, data, "it should set the store");
       assert.deepEqual(
-        state.store.subnetTiers,
+        craig.store.subnetTiers,
         {
           management: [
             { name: "vpe", zones: 3 },
@@ -2639,12 +2631,11 @@ describe("state util functions", () => {
       );
     });
     it("should set JSON data if not valid but slz", () => {
-      let state = newState();
-      state.setUpdateCallback(() => {});
+      craig.setUpdateCallback(() => {});
       delete json.ssh_keys[1]; // remove extra ssh key that should not be there lol
-      state.hardSetJson({}, true);
+      craig.hardSetJson({}, true);
       assert.deepEqual(
-        state.store.subnetTiers,
+        craig.store.subnetTiers,
         {
           management: [
             { name: "vsi", zones: 3 },
@@ -2660,8 +2651,7 @@ describe("state util functions", () => {
       );
     });
     it("should convert permitted networks to vpcs on hard set", () => {
-      let state = newState();
-      state.setUpdateCallback(() => {});
+      craig.setUpdateCallback(() => {});
       json.dns.push({
         name: "dns",
         resource_group: "management-rg",
@@ -2673,17 +2663,16 @@ describe("state util functions", () => {
         name: "hi",
         permitted_networks: ["management"],
       });
-      state.hardSetJson({ ...json });
-      assert.deepEqual(state.store.json.dns[0].zones[0], {
+      craig.hardSetJson({ ...json });
+      assert.deepEqual(craig.store.json.dns[0].zones[0], {
         instance: "dns",
         name: "hi",
         vpcs: ["management"],
       });
     });
     it("should not convert anything if permitted networks doesn't exist", () => {
-      let state = newState();
       json._options.dynamic_subnets = true;
-      state.setUpdateCallback(() => {});
+      craig.setUpdateCallback(() => {});
       json.dns.push({
         name: "dns",
         resource_group: "management-rg",
@@ -2695,26 +2684,25 @@ describe("state util functions", () => {
         name: "hi",
         vpcs: ["management"],
       });
-      state.hardSetJson({ ...json });
-      assert.deepEqual(state.store.json.dns[0].zones[0], {
+      craig.hardSetJson({ ...json });
+      assert.deepEqual(craig.store.json.dns[0].zones[0], {
         instance: "dns",
         name: "hi",
         vpcs: ["management"],
       });
       assert.isTrue(
-        state.store.json._options.dynamic_subnets,
+        craig.store.json._options.dynamic_subnets,
         "it should be true"
       );
     });
     it("should set JSON data if valid", () => {
-      let state = newState();
-      state.store = {
+      craig.store = {
         json: {},
       };
-      state.setUpdateCallback(() => {});
-      state.hardSetJson({ ...brokenSubnets });
+      craig.setUpdateCallback(() => {});
+      craig.hardSetJson({ ...brokenSubnets });
       assert.deepEqual(
-        state.store.subnetTiers,
+        craig.store.subnetTiers,
         {
           vpc: [
             { name: "vsi", zones: 3 },
@@ -2727,69 +2715,63 @@ describe("state util functions", () => {
   });
   describe("getAllRuleNames", () => {
     it("should return empty array if no params", () => {
-      let state = newState();
-      let actualData = state.getAllRuleNames();
-      assert.deepEqual(actualData, [], "it should return an empty array");
+      assert.deepEqual(
+        craig.getAllRuleNames(),
+        [],
+        "it should return an empty array"
+      );
     });
     it("should return the names of all rules in a security group when no source acl name", () => {
-      let state = newState();
-      let actualData = state.getAllRuleNames("management-vpe");
-      let expectedData = [
-        "allow-ibm-inbound",
-        "allow-vpc-inbound",
-        "allow-vpc-outbound",
-        "allow-ibm-tcp-53-outbound",
-        "allow-ibm-tcp-80-outbound",
-        "allow-ibm-tcp-443-outbound",
-      ];
       assert.deepEqual(
-        actualData,
-        expectedData,
+        craig.getAllRuleNames("management-vpe"),
+        [
+          "allow-ibm-inbound",
+          "allow-vpc-inbound",
+          "allow-vpc-outbound",
+          "allow-ibm-tcp-53-outbound",
+          "allow-ibm-tcp-80-outbound",
+          "allow-ibm-tcp-443-outbound",
+        ],
         "it should return correct rule names"
       );
     });
     it("should return the names of all rules in an acl when two params are passed", () => {
-      let state = newState();
-      let actualData = state.getAllRuleNames("management", "management");
-      let expectedData = [
-        "allow-ibm-inbound",
-        "allow-ibm-outbound",
-        "allow-all-network-inbound",
-        "allow-all-network-outbound",
-      ];
       assert.deepEqual(
-        actualData,
-        expectedData,
+        craig.getAllRuleNames("management", "management"),
+        [
+          "allow-ibm-inbound",
+          "allow-ibm-outbound",
+          "allow-all-network-inbound",
+          "allow-all-network-outbound",
+        ],
         "it should return correct rule names"
       );
     });
   });
   describe("getAllOtherGroups", () => {
     it("should return empty array if rule source is null or empty string", () => {
-      let state = newState();
-      let actualData = state.getAllOtherGroups({ ruleSource: "" });
-      assert.deepEqual(actualData, [], "it should return empty array");
+      assert.deepEqual(
+        craig.getAllOtherGroups({ ruleSource: "" }),
+        [],
+        "it should return empty array"
+      );
     });
     it("should return all other acl names if rule source and isAclForm", () => {
-      let state = newState();
-      let actualData = state.getAllOtherGroups(
-        { ruleSource: "management" },
-        { isAclForm: true }
-      );
       assert.deepEqual(
-        actualData,
+        craig.getAllOtherGroups(
+          { ruleSource: "management" },
+          { isAclForm: true }
+        ),
         ["workload"],
         "it should return empty array"
       );
     });
     it("should return all other security groups if rule source and not isAclForm", () => {
-      let state = newState();
-      let actualData = state.getAllOtherGroups(
-        { ruleSource: "management-vpe" },
-        { isAclForm: false }
-      );
       assert.deepEqual(
-        actualData,
+        craig.getAllOtherGroups(
+          { ruleSource: "management-vpe" },
+          { isAclForm: false }
+        ),
         ["workload-vpe", "management-vsi"],
         "it should return empty array"
       );
@@ -2797,10 +2779,8 @@ describe("state util functions", () => {
   });
   describe("getAllResourceKeys", () => {
     it("should get a list of keys from the default pattern", () => {
-      let state = newState();
-      let actualData = state.getAllResourceKeys();
       assert.deepEqual(
-        actualData,
+        craig.getAllResourceKeys(),
         [
           {
             cos: "atracker-cos",
@@ -2810,7 +2790,7 @@ describe("state util functions", () => {
         ],
         "it should return correct data"
       );
-      state.store.json.appid = [
+      craig.store.json.appid = [
         {
           name: "default",
           keys: [
@@ -2819,37 +2799,30 @@ describe("state util functions", () => {
           resource_group: null,
         },
       ];
-      actualData = state.getAllResourceKeys();
       assert.deepEqual(
-        actualData,
-        [
-          {
-            cos: "atracker-cos",
-            key: "cos-bind-key",
-            ref: "ibm_resource_key.atracker_cos_object_storage_key_cos_bind_key",
-          },
-          {
-            appid: "default",
-            key: "test",
-            ref: "ibm_resource_key.default_key_test",
-          },
-        ],
+        craig.getAllResourceKeys()[1],
+
+        {
+          appid: "default",
+          key: "test",
+          ref: "ibm_resource_key.default_key_test",
+        },
+
         "it should return correct data with appid"
       );
-      state.store.json.logdna = {
+      craig.store.json.logdna = {
         plan: "lite",
         platform_logs: true,
         resource_group: "service-rg",
         enabled: true,
       };
-      state.store.json.sysdig = {
+      craig.store.json.sysdig = {
         plan: "lite",
         resource_group: "service-rg",
         enabled: true,
       };
-      actualData = state.getAllResourceKeys();
       assert.deepEqual(
-        actualData,
+        craig.getAllResourceKeys(),
         [
           {
             cos: "atracker-cos",
diff --git a/unit-tests/state/transit-gateways.test.js b/unit-tests/state/transit-gateways.test.js
index 374f4527..eac7db64 100644
--- a/unit-tests/state/transit-gateways.test.js
+++ b/unit-tests/state/transit-gateways.test.js
@@ -12,52 +12,52 @@ function newState() {
 }
 
 describe("transit_gateways", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("transit_gateways.init", () => {
     it("should initialize default transit gateway as an array", () => {
-      let state = new newState();
-      let expectedData = [
-        {
-          name: "transit-gateway",
-          resource_group: "service-rg",
-          global: false,
-          connections: [
-            {
-              tgw: "transit-gateway",
-              vpc: "management",
-            },
-            {
-              tgw: "transit-gateway",
-              vpc: "workload",
-            },
-          ],
-        },
-      ];
       assert.deepEqual(
-        state.store.json.transit_gateways,
-        expectedData,
+        craig.store.json.transit_gateways,
+        [
+          {
+            name: "transit-gateway",
+            resource_group: "service-rg",
+            global: false,
+            connections: [
+              {
+                tgw: "transit-gateway",
+                vpc: "management",
+              },
+              {
+                tgw: "transit-gateway",
+                vpc: "workload",
+              },
+            ],
+          },
+        ],
         "it should be equal"
       );
     });
   });
   describe("transit_gateways.onStoreUpdate", () => {
     it("should remove a connection when a vpc is deleted", () => {
-      let state = new newState();
-      state.vpcs.delete({}, { data: { name: "management" } });
+      craig.vpcs.delete({}, { data: { name: "management" } });
       assert.deepEqual(
-        state.store.json.transit_gateways[0].connections,
+        craig.store.json.transit_gateways[0].connections,
         [{ tgw: "transit-gateway", vpc: "workload" }],
         "it should only have one connection"
       );
     });
     it("should remove a connection when a power vs workspace is deleted", () => {
-      let state = new newState();
-      state.store.json._options.power_vs_zones = ["dal10", "dal12"];
-      state.power.create({
+      craig.store.json._options.power_vs_zones = ["dal10", "dal12"];
+      craig.power.create({
         name: "toad",
         imageNames: ["7100-05-09"],
         zone: "dal10",
       });
-      state.transit_gateways.save(
+      craig.transit_gateways.save(
         {
           connections: [
             { tgw: "todd", vpc: "management" },
@@ -71,7 +71,7 @@ describe("transit_gateways", () => {
           },
         }
       );
-      state.power.delete(
+      craig.power.delete(
         {},
         {
           data: {
@@ -80,7 +80,7 @@ describe("transit_gateways", () => {
         }
       );
       assert.deepEqual(
-        state.store.json.transit_gateways[0].connections,
+        craig.store.json.transit_gateways[0].connections,
         [
           { tgw: "transit-gateway", vpc: "management" },
           { tgw: "transit-gateway", vpc: "workload" },
@@ -89,14 +89,13 @@ describe("transit_gateways", () => {
       );
     });
     it("should remove a connection when a power vs workspace is not in an edge enabled zone", () => {
-      let state = new newState();
-      state.store.json._options.power_vs_zones = ["dal10", "dal12"];
-      state.power.create({
+      craig.store.json._options.power_vs_zones = ["dal10", "dal12"];
+      craig.power.create({
         name: "toad",
         imageNames: ["7100-05-09"],
         zone: "dal10",
       });
-      state.transit_gateways.save(
+      craig.transit_gateways.save(
         {
           connections: [
             { tgw: "todd", vpc: "management" },
@@ -110,7 +109,7 @@ describe("transit_gateways", () => {
           },
         }
       );
-      state.power.save(
+      craig.power.save(
         {
           name: "toad",
           imageNames: ["7100-05-09"],
@@ -123,7 +122,7 @@ describe("transit_gateways", () => {
         }
       );
       assert.deepEqual(
-        state.store.json.transit_gateways[0].connections,
+        craig.store.json.transit_gateways[0].connections,
         [
           { tgw: "transit-gateway", vpc: "management" },
           { tgw: "transit-gateway", vpc: "workload" },
@@ -132,14 +131,13 @@ describe("transit_gateways", () => {
       );
     });
     it("should add a connection when crns is provided", () => {
-      let state = new newState();
-      state.transit_gateways.save(
+      craig.transit_gateways.save(
         { name: "todd", resource_group: "management-rg", crns: ["crn"] },
         { data: { name: "transit-gateway" } }
       );
 
       assert.deepEqual(
-        state.store.json.transit_gateways[0].connections,
+        craig.store.json.transit_gateways[0].connections,
         [
           { tgw: "todd", vpc: "management" },
           { tgw: "todd", vpc: "workload" },
@@ -149,12 +147,11 @@ describe("transit_gateways", () => {
       );
     });
     it("should add a connection when crns is provided and adding a second one", () => {
-      let state = new newState();
-      state.transit_gateways.save(
+      craig.transit_gateways.save(
         { name: "todd", resource_group: "management-rg", crns: ["crn"] },
         { data: { name: "transit-gateway" } }
       );
-      state.transit_gateways.save(
+      craig.transit_gateways.save(
         {
           name: "todd",
           resource_group: "management-rg",
@@ -164,7 +161,7 @@ describe("transit_gateways", () => {
       );
 
       assert.deepEqual(
-        state.store.json.transit_gateways[0].connections,
+        craig.store.json.transit_gateways[0].connections,
         [
           { tgw: "todd", vpc: "management" },
           { tgw: "todd", vpc: "workload" },
@@ -175,12 +172,11 @@ describe("transit_gateways", () => {
       );
     });
     it("should remove a crn connection when a crn is removed", () => {
-      let state = new newState();
-      state.transit_gateways.save(
+      craig.transit_gateways.save(
         { name: "todd", resource_group: "management-rg", crns: ["crn"] },
         { data: { name: "transit-gateway" } }
       );
-      state.transit_gateways.save(
+      craig.transit_gateways.save(
         {
           name: "todd",
           resource_group: "management-rg",
@@ -189,7 +185,7 @@ describe("transit_gateways", () => {
         { data: { name: "todd" } }
       );
 
-      state.transit_gateways.save(
+      craig.transit_gateways.save(
         {
           name: "todd",
           resource_group: "management-rg",
@@ -199,7 +195,7 @@ describe("transit_gateways", () => {
       );
 
       assert.deepEqual(
-        state.store.json.transit_gateways[0].connections,
+        craig.store.json.transit_gateways[0].connections,
         [
           { tgw: "todd", vpc: "management" },
           { tgw: "todd", vpc: "workload" },
@@ -209,12 +205,11 @@ describe("transit_gateways", () => {
       );
     });
     it("should not remove crn connections", () => {
-      let state = new newState();
-      state.store.json.transit_gateways[0].connections[0].crn = "crn";
-      delete state.store.json.transit_gateways[0].connections[0].vpc;
-      state.vpcs.delete({}, { data: { name: "management" } });
+      craig.store.json.transit_gateways[0].connections[0].crn = "crn";
+      delete craig.store.json.transit_gateways[0].connections[0].vpc;
+      craig.vpcs.delete({}, { data: { name: "management" } });
       assert.deepEqual(
-        state.store.json.transit_gateways[0].connections,
+        craig.store.json.transit_gateways[0].connections,
         [
           { tgw: "transit-gateway", crn: "crn" },
           { tgw: "transit-gateway", vpc: "workload" },
@@ -223,10 +218,9 @@ describe("transit_gateways", () => {
       );
     });
     it("should set resource group to null if deleted", () => {
-      let state = new newState();
-      state.resource_groups.delete({}, { data: { name: "service-rg" } });
+      craig.resource_groups.delete({}, { data: { name: "service-rg" } });
       assert.deepEqual(
-        state.store.json.transit_gateways[0].resource_group,
+        craig.store.json.transit_gateways[0].resource_group,
         null,
         "it should be null"
       );
@@ -234,8 +228,7 @@ describe("transit_gateways", () => {
   });
   describe("transit_gateways.create", () => {
     it("should create a new transit gateway", () => {
-      let state = new newState();
-      state.transit_gateways.create({
+      craig.transit_gateways.create({
         use_data: true,
         name: "tg-test",
         resource_group: "management-rg",
@@ -252,7 +245,7 @@ describe("transit_gateways", () => {
         prefix_filters: [],
       };
       assert.deepEqual(
-        state.store.json.transit_gateways[1],
+        craig.store.json.transit_gateways[1],
         expectedData,
         "it should be second tg"
       );
@@ -260,44 +253,22 @@ describe("transit_gateways", () => {
   });
   describe("transit_gateways.save", () => {
     it("should update transit gateway", () => {
-      let state = new newState();
-      state.transit_gateways.save(
+      craig.transit_gateways.save(
         { name: "todd", resource_group: "management-rg" },
         { data: { name: "transit-gateway" } }
       );
-      let expectedData = [
-        {
-          use_data: false,
-          name: "todd",
-          resource_group: "management-rg",
-          global: false,
-          connections: [
-            {
-              tgw: "todd",
-              vpc: "management",
-            },
-            {
-              tgw: "todd",
-              vpc: "workload",
-            },
-          ],
-          gre_tunnels: [],
-          prefix_filters: [],
-        },
-      ];
       assert.deepEqual(
-        state.store.json.transit_gateways,
-        expectedData,
+        craig.store.json.transit_gateways[0].name,
+        "todd",
         "it should change name and rg"
       );
     });
   });
   describe("transit_gateways.delete", () => {
     it("should delete transit gateway", () => {
-      let state = new newState();
-      state.transit_gateways.delete({}, { data: { name: "transit-gateway" } });
+      craig.transit_gateways.delete({}, { data: { name: "transit-gateway" } });
       assert.deepEqual(
-        state.store.json.transit_gateways,
+        craig.store.json.transit_gateways,
         [],
         "it should be empty"
       );
@@ -307,15 +278,13 @@ describe("transit_gateways", () => {
     describe("resource_groups", () => {
       describe("groups", () => {
         it("should return resource groups", () => {
-          let state = newState();
           assert.deepEqual(
-            state.transit_gateways.resource_group.groups({}, { craig: state }),
+            craig.transit_gateways.resource_group.groups({}, { craig: craig }),
             ["service-rg", "management-rg", "workload-rg"],
             "it should return correct data"
           );
         });
         it("should not have invalid resource group when use data", () => {
-          let craig = newState();
           assert.isFalse(
             craig.transit_gateways.resource_group.invalid({ use_data: true }),
             "it should be invalid"
@@ -324,11 +293,10 @@ describe("transit_gateways", () => {
       });
       describe("hideWhen", () => {
         it("should return resource groups", () => {
-          let state = newState();
           assert.isTrue(
-            state.transit_gateways.resource_group.hideWhen(
+            craig.transit_gateways.resource_group.hideWhen(
               { use_data: true },
-              { craig: state }
+              { craig: craig }
             ),
             "it should return correct data"
           );
@@ -338,7 +306,6 @@ describe("transit_gateways", () => {
     describe("vpc_connections", () => {
       describe("groups", () => {
         it("should return groups", () => {
-          let craig = newState();
           assert.deepEqual(
             craig.transit_gateways.vpc_connections.groups({}, { craig: craig }),
             ["management", "workload"],
@@ -346,7 +313,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should return groups when tgw is global and management is already attached to a different global transit gateway", () => {
-          let craig = newState();
           craig.transit_gateways.create({
             name: "transit-gateway2",
             resource_group: "service-rg",
@@ -376,7 +342,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should return groups when tgw is local and management is already attached to a different local transit gateway", () => {
-          let craig = newState();
           craig.transit_gateways.create({
             name: "transit-gateway2",
             resource_group: "service-rg",
@@ -406,7 +371,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should return groups when tgw is local and management is already attached to a different local transit gateway in modal", () => {
-          let craig = newState();
           craig.transit_gateways.save(
             {
               connections: [
@@ -434,7 +398,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should set connections on input change for global", () => {
-          let craig = newState();
           let data = {
             global: false,
           };
@@ -449,7 +412,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should set connections when enabling classic connections", () => {
-          let craig = newState();
           let data = {
             classic: false,
             connections: [{ tgw: "transit-gateway", vpc: "vpc" }],
@@ -470,7 +432,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should set connections when disabling classic connections", () => {
-          let craig = newState();
           let data = {
             classic: true,
             connections: [
@@ -491,7 +452,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should have force update key for connections", () => {
-          let craig = newState();
           assert.deepEqual(
             craig.transit_gateways.vpc_connections.forceUpdateKey({
               global: true,
@@ -510,7 +470,6 @@ describe("transit_gateways", () => {
       });
       describe("onRender", () => {
         it("should return string list of vpc values", () => {
-          let craig = newState();
           assert.deepEqual(
             craig.transit_gateways.vpc_connections.onRender(
               {
@@ -546,7 +505,6 @@ describe("transit_gateways", () => {
             ],
             vpc_connections: ["frog"],
           };
-          let craig = newState();
           craig.transit_gateways.vpc_connections.onStateChange(stateData);
           assert.deepEqual(
             stateData,
@@ -568,7 +526,6 @@ describe("transit_gateways", () => {
     describe("power_connections", () => {
       describe("groups", () => {
         it("should return groups", () => {
-          let craig = newState();
           craig.store.json._options.power_vs_zones = ["dal10", "dal12"];
           craig.power.create({
             name: "power",
@@ -592,7 +549,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should return groups when one power workspace is attached to a different transit gateway with the same global setting in modal", () => {
-          let craig = newState();
           craig.store.json._options.power_vs_zones = ["dal10", "dal12"];
           craig.power.create({
             name: "power",
@@ -627,7 +583,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should return groups when one power workspace is attached to a different transit gateway with the same global setting as form", () => {
-          let craig = newState();
           craig.store.json._options.power_vs_zones = ["dal10", "dal12"];
           craig.power.create({
             name: "power",
@@ -669,7 +624,6 @@ describe("transit_gateways", () => {
       });
       describe("onRender", () => {
         it("should return string list of vpc values", () => {
-          let craig = newState();
           assert.deepEqual(
             craig.transit_gateways.power_connections.onRender({
               connections: [
@@ -704,10 +658,8 @@ describe("transit_gateways", () => {
             ],
             power_connections: ["power", "power-also"],
           };
-          let craig = newState();
           craig.transit_gateways.power_connections.onStateChange(stateData);
           assert.deepEqual(
-            stateData,
             {
               connections: [
                 {
@@ -722,6 +674,7 @@ describe("transit_gateways", () => {
               ],
               name: "tgw",
             },
+            stateData,
             "it should return correct data"
           );
         });
@@ -730,14 +683,13 @@ describe("transit_gateways", () => {
     describe("crns", () => {
       describe("invalidText", () => {
         it("should return true when invalid crn in list", () => {
-          let state = new newState();
           assert.isTrue(
-            state.transit_gateways.crns.invalidText({
+            craig.transit_gateways.crns.invalidText({
               crns: ["crn:v1:bluemix:public:abcdf", "mooseeeeeeeeeeeeeeeeee"],
             })
           );
           assert.isFalse(
-            state.transit_gateways.crns.invalidText({
+            craig.transit_gateways.crns.invalidText({
               crns: undefined,
             })
           );
@@ -748,9 +700,8 @@ describe("transit_gateways", () => {
   describe("transit_gateways.gre_tunnels", () => {
     describe("transit_gateways.gre_tunnels.create", () => {
       it("should create a gre tunnel", () => {
-        let state = newState();
-        state.update();
-        state.transit_gateways.gre_tunnels.create(
+        craig.update();
+        craig.transit_gateways.gre_tunnels.create(
           {
             tgw: "transit-gateway",
             remote_bgp_asn: 12345,
@@ -766,7 +717,7 @@ describe("transit_gateways", () => {
           }
         );
         assert.deepEqual(
-          state.store.json.transit_gateways[0].gre_tunnels[0],
+          craig.store.json.transit_gateways[0].gre_tunnels[0],
           {
             tgw: "transit-gateway",
             remote_bgp_asn: 12345,
@@ -779,8 +730,7 @@ describe("transit_gateways", () => {
         );
       });
       it("should create a gre tunnel with gateway", () => {
-        let state = newState();
-        state.classic_gateways.create({
+        craig.classic_gateways.create({
           name: "gw",
           hostname: "gw-host",
           datacenter: "dal10",
@@ -801,7 +751,7 @@ describe("transit_gateways", () => {
           disk_key_names: ["HARD_DRIVE_2_00_TB_SATA_2"],
           hadr: false,
         });
-        state.transit_gateways.gre_tunnels.create(
+        craig.transit_gateways.gre_tunnels.create(
           {
             tgw: "transit-gateway",
             remote_bgp_asn: 12345,
@@ -817,7 +767,7 @@ describe("transit_gateways", () => {
           }
         );
         assert.deepEqual(
-          state.store.json.transit_gateways[0].gre_tunnels[0],
+          craig.store.json.transit_gateways[0].gre_tunnels[0],
           {
             tgw: "transit-gateway",
             remote_bgp_asn: 12345,
@@ -832,8 +782,7 @@ describe("transit_gateways", () => {
     });
     describe("transit_gateways.gre_tunnels.save", () => {
       it("should update a gre tunnel with gateway", () => {
-        let state = newState();
-        state.classic_gateways.create({
+        craig.classic_gateways.create({
           name: "gw",
           hostname: "gw-host",
           datacenter: "dal10",
@@ -854,7 +803,7 @@ describe("transit_gateways", () => {
           disk_key_names: ["HARD_DRIVE_2_00_TB_SATA_2"],
           hadr: false,
         });
-        state.transit_gateways.gre_tunnels.create(
+        craig.transit_gateways.gre_tunnels.create(
           {
             tgw: "transit-gateway",
             remote_bgp_asn: 12345,
@@ -869,7 +818,7 @@ describe("transit_gateways", () => {
             },
           }
         );
-        state.transit_gateways.gre_tunnels.save(
+        craig.transit_gateways.gre_tunnels.save(
           {
             tgw: "transit-gateway",
             remote_bgp_asn: 12345,
@@ -886,7 +835,7 @@ describe("transit_gateways", () => {
           }
         );
         assert.deepEqual(
-          state.store.json.transit_gateways[0].gre_tunnels[0],
+          craig.store.json.transit_gateways[0].gre_tunnels[0],
           {
             tgw: "transit-gateway",
             remote_bgp_asn: 12345,
@@ -901,8 +850,7 @@ describe("transit_gateways", () => {
     });
     describe("transit_gateways.gre_tunnels.delete", () => {
       it("should delete a gre tunnel with gateway", () => {
-        let state = newState();
-        state.classic_gateways.create({
+        craig.classic_gateways.create({
           name: "gw",
           hostname: "gw-host",
           datacenter: "dal10",
@@ -923,7 +871,7 @@ describe("transit_gateways", () => {
           disk_key_names: ["HARD_DRIVE_2_00_TB_SATA_2"],
           hadr: false,
         });
-        state.transit_gateways.gre_tunnels.create(
+        craig.transit_gateways.gre_tunnels.create(
           {
             tgw: "transit-gateway",
             remote_bgp_asn: 12345,
@@ -938,7 +886,7 @@ describe("transit_gateways", () => {
             },
           }
         );
-        state.transit_gateways.gre_tunnels.delete(
+        craig.transit_gateways.gre_tunnels.delete(
           {},
           {
             arrayParentName: "transit-gateway",
@@ -948,14 +896,13 @@ describe("transit_gateways", () => {
           }
         );
         assert.deepEqual(
-          state.store.json.transit_gateways[0].gre_tunnels,
+          craig.store.json.transit_gateways[0].gre_tunnels,
           [],
           "it should create tunnel"
         );
       });
       it("should delete a gre tunnel with null gateway", () => {
-        let state = newState();
-        state.classic_gateways.create({
+        craig.classic_gateways.create({
           name: "gw",
           hostname: "gw-host",
           datacenter: "dal10",
@@ -976,7 +923,7 @@ describe("transit_gateways", () => {
           disk_key_names: ["HARD_DRIVE_2_00_TB_SATA_2"],
           hadr: false,
         });
-        state.classic_gateways.create({
+        craig.classic_gateways.create({
           name: "gw2",
           hostname: "gw-host",
           datacenter: "dal10",
@@ -997,7 +944,7 @@ describe("transit_gateways", () => {
           disk_key_names: ["HARD_DRIVE_2_00_TB_SATA_2"],
           hadr: false,
         });
-        state.transit_gateways.gre_tunnels.create(
+        craig.transit_gateways.gre_tunnels.create(
           {
             tgw: "transit-gateway",
             remote_bgp_asn: 12345,
@@ -1012,7 +959,7 @@ describe("transit_gateways", () => {
             },
           }
         );
-        state.transit_gateways.gre_tunnels.create(
+        craig.transit_gateways.gre_tunnels.create(
           {
             tgw: "transit-gateway",
             remote_bgp_asn: 12345,
@@ -1027,8 +974,8 @@ describe("transit_gateways", () => {
             },
           }
         );
-        state.classic_gateways.delete({}, { data: { name: "gw" } });
-        state.transit_gateways.gre_tunnels.delete(
+        craig.classic_gateways.delete({}, { data: { name: "gw" } });
+        craig.transit_gateways.gre_tunnels.delete(
           {},
           {
             arrayParentName: "transit-gateway",
@@ -1038,7 +985,7 @@ describe("transit_gateways", () => {
           }
         );
         assert.deepEqual(
-          state.store.json.transit_gateways[0].gre_tunnels,
+          craig.store.json.transit_gateways[0].gre_tunnels,
           [
             {
               gateway: "gw2",
@@ -1057,7 +1004,6 @@ describe("transit_gateways", () => {
       describe("transit_gateways.gre_tunnels.schema.gateway", () => {
         describe("transit_gateways.gre_tunnels.schema.gateway.groups", () => {
           it("should return groups", () => {
-            let craig = newState();
             craig.classic_gateways.create({
               name: "gw",
               hostname: "gw-host",
@@ -1108,7 +1054,6 @@ describe("transit_gateways", () => {
             );
           });
           it("should return groups and filter out gateways with a GRE tunnel to the current gateway", () => {
-            let craig = newState();
             craig.classic_gateways.create({
               name: "gw",
               hostname: "gw-host",
@@ -1149,7 +1094,6 @@ describe("transit_gateways", () => {
       describe("transit_gateways.gre_tunnels.schema.local_tunnel_ip", () => {
         describe("transit_gateways.gre_tunnels.schema.local_tunnel_ip.invalid", () => {
           it("should return true if not an ipv4 address", () => {
-            let craig = newState();
             assert.isTrue(
               craig.transit_gateways.gre_tunnels.local_tunnel_ip.invalid({
                 local_tunnel_ip: "aa",
@@ -1158,7 +1102,6 @@ describe("transit_gateways", () => {
             );
           });
           it("should return true if an ipv4 cidr address", () => {
-            let craig = newState();
             assert.isTrue(
               craig.transit_gateways.gre_tunnels.local_tunnel_ip.invalid({
                 local_tunnel_ip: "10.10.10.10/10",
@@ -1169,7 +1112,6 @@ describe("transit_gateways", () => {
         });
         describe("transit_gateways.gre_tunnels.schema.local_tunnel_ip.invalidText", () => {
           it("should return invalid text", () => {
-            let craig = newState();
             assert.deepEqual(
               craig.transit_gateways.gre_tunnels.local_tunnel_ip.invalidText(),
               "Enter a valid IP address",
@@ -1182,7 +1124,6 @@ describe("transit_gateways", () => {
   });
   describe("transit_gateways.prefix_filters.create", () => {
     it("should create a prefix filter", () => {
-      let craig = newState();
       craig.update();
       craig.transit_gateways.prefix_filters.create(
         {
@@ -1221,7 +1162,6 @@ describe("transit_gateways", () => {
   });
   describe("transit_gateways.prefix_filters.save", () => {
     it("should create a prefix filter", () => {
-      let craig = newState();
       craig.update();
       craig.transit_gateways.prefix_filters.create(
         {
@@ -1260,26 +1200,14 @@ describe("transit_gateways", () => {
         }
       );
       assert.deepEqual(
-        craig.store.json.transit_gateways[0].prefix_filters,
-        [
-          {
-            name: "oops",
-            tgw: "transit-gateway",
-            connection_type: "vpc",
-            target: "management",
-            action: "permit",
-            prefix: "10.10.10.10/10",
-            le: 0,
-            ge: 32,
-          },
-        ],
+        craig.store.json.transit_gateways[0].prefix_filters[0].name,
+        "oops",
         "it should create a gatway"
       );
     });
   });
   describe("transit_gateways.prefix_filters.delete", () => {
     it("should create a prefix filter", () => {
-      let craig = newState();
       craig.update();
       craig.transit_gateways.prefix_filters.create(
         {
@@ -1324,7 +1252,6 @@ describe("transit_gateways", () => {
   });
   describe("transit_gateways.prefix_filters.shouldDisableSave", () => {
     it("should return true if a prefix filter has an invalid duplicate name", () => {
-      let craig = newState();
       craig.update();
       craig.transit_gateways.prefix_filters.create(
         {
@@ -1356,7 +1283,6 @@ describe("transit_gateways", () => {
     describe("transit_gateways.prefix_filters.connection_type", () => {
       describe("transit_gateways.prefix_filters.connection_type.invalid", () => {
         it("should return true if is null or empty string", () => {
-          let craig = newState();
           assert.isTrue(
             craig.transit_gateways.prefix_filters.connection_type.invalid({
               connection_type: "",
@@ -1370,7 +1296,6 @@ describe("transit_gateways", () => {
           let data = {
             connection_type: "",
           };
-          let craig = newState();
           craig.transit_gateways.prefix_filters.connection_type.onStateChange(
             data
           ),
@@ -1388,7 +1313,6 @@ describe("transit_gateways", () => {
     describe("transit_gateways.prefix_filters.le", () => {
       describe("transit_gateways.prefix_filters.le.invalidText", () => {
         it("should return correct invalid text", () => {
-          let craig = newState();
           assert.deepEqual(
             craig.transit_gateways.prefix_filters.le.invalidText(),
             "Enter a whole number",
@@ -1398,14 +1322,12 @@ describe("transit_gateways", () => {
       });
       describe("transit_gateways.prefix_filters.le.invalid", () => {
         it("should return true when not a whole number", () => {
-          let craig = newState();
           assert.isTrue(
             craig.transit_gateways.prefix_filters.le.invalid({ le: "a" }),
             "it should return correct text"
           );
         });
         it("should return true when not a whole number", () => {
-          let craig = newState();
           assert.isTrue(
             craig.transit_gateways.prefix_filters.le.invalid({ le: "1a" }),
             "it should return correct text"
@@ -1416,7 +1338,6 @@ describe("transit_gateways", () => {
     describe("transit_gateways.prefix_filters.action", () => {
       describe("transit_gateways.prefix_filters.action.invalidText", () => {
         it("should return correct invalid text", () => {
-          let craig = newState();
           assert.deepEqual(
             craig.transit_gateways.prefix_filters.action.invalidText(),
             "Select an action",
@@ -1428,7 +1349,6 @@ describe("transit_gateways", () => {
     describe("transit_gateways.prefix_filters.prefix", () => {
       describe("transit_gateways.prefix_filters.prefix.invalid", () => {
         it("should return true when not a cidr block", () => {
-          let craig = newState();
           assert.isTrue(
             craig.transit_gateways.prefix_filters.prefix.invalid({
               prefix: "aaaa",
@@ -1437,14 +1357,12 @@ describe("transit_gateways", () => {
           );
         });
         it("should return true when not a cidr block", () => {
-          let craig = newState();
           assert.isTrue(
             craig.transit_gateways.prefix_filters.prefix.invalid({}),
             "it should return correct text"
           );
         });
         it("should return true when an ipv4 address but not a cidr block", () => {
-          let craig = newState();
           assert.isTrue(
             craig.transit_gateways.prefix_filters.prefix.invalid({
               prefix: "1.2.3.4",
@@ -1455,7 +1373,6 @@ describe("transit_gateways", () => {
       });
       describe("transit_gateways.prefix_filters.prefix.invalidText", () => {
         it("should return correct invalid text", () => {
-          let craig = newState();
           assert.deepEqual(
             craig.transit_gateways.prefix_filters.prefix.invalidText(),
             "Enter a valid IPV4 CIDR Block",
@@ -1467,7 +1384,6 @@ describe("transit_gateways", () => {
     describe("transit_gateways.prefix_filters.target", () => {
       describe("transit_gateways.prefix_filters.target.groups", () => {
         it("should return correct connection types for no connection type", () => {
-          let craig = newState();
           assert.deepEqual(
             craig.transit_gateways.prefix_filters.target.groups(
               { connection_type: "" },
@@ -1478,7 +1394,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should return correct connection types for vpc", () => {
-          let craig = newState();
           craig.store.json.transit_gateways[0].connections.push({
             tgw: "transit-gateway",
             power: "toad",
@@ -1493,7 +1408,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should return correct connection types for gre", () => {
-          let craig = newState();
           craig.update();
           assert.deepEqual(
             craig.transit_gateways.prefix_filters.target.groups(
@@ -1505,7 +1419,6 @@ describe("transit_gateways", () => {
           );
         });
         it("should return correct connection types for power", () => {
-          let craig = newState();
           craig.power.create({
             name: "toad",
             imageNames: ["7100-05-09"],
diff --git a/unit-tests/state/vpc.test.js b/unit-tests/state/vpc.test.js
index 0a86e79e..5ec2021d 100644
--- a/unit-tests/state/vpc.test.js
+++ b/unit-tests/state/vpc.test.js
@@ -1,6 +1,6 @@
 const { assert } = require("chai");
 const { state } = require("../../client/src/lib/state");
-const { contains } = require("lazy-z");
+const { contains, splatContains } = require("lazy-z");
 
 /**
  * initialize store
@@ -14,9 +14,12 @@ function newState(legacy) {
 }
 
 describe("vpcs", () => {
+  let state;
+  beforeEach(() => {
+    state = newState();
+  });
   describe("vpcs.save", () => {
     it("should rename a vpc", () => {
-      let state = new newState();
       state.store.json.dns = [
         {
           name: "frog",
@@ -64,7 +67,6 @@ describe("vpcs", () => {
       );
     });
     it("should rename a vpc", () => {
-      let state = new newState();
       state.store.json.dns = [
         {
           name: "frog",
@@ -112,7 +114,6 @@ describe("vpcs", () => {
       );
     });
     it("should add a pgw to a vpc", () => {
-      let state = new newState();
       state.vpcs.save(
         { name: "todd", default_network_acl_name: "", publicGateways: [1] },
         { data: { name: "management" } }
@@ -142,7 +143,6 @@ describe("vpcs", () => {
       );
     });
     it("should change edge vpc name when updating edge vpc", () => {
-      let state = new newState();
       state.store.edge_vpc_name = "management";
       state.store.json.dns = [
         {
@@ -180,7 +180,6 @@ describe("vpcs", () => {
       assert.deepEqual(state.store.edge_vpc_name, "todd", "it should be todd");
     });
     it("should update another field", () => {
-      let state = new newState();
       state.vpcs.save(
         {
           name: "management",
@@ -213,7 +212,6 @@ describe("vpcs", () => {
       );
     });
     it("should correctly save a vpc with no subnet tiers", () => {
-      let state = new newState();
       state.vpcs.create({ name: "test" });
       state.vpcs.save(
         { default_network_acl_name: "todd" },
@@ -226,123 +224,20 @@ describe("vpcs", () => {
       );
     });
     it("should update pgw vpc on store update", () => {
-      let craig = newState();
-      craig.store.json.vpcs[0].use_data = false;
-      craig.store.json.vpcs[0].acls[0].use_data = true;
-      craig.vpcs.save(
+      state.store.json.vpcs[0].use_data = false;
+      state.store.json.vpcs[0].acls[0].use_data = true;
+      state.vpcs.save(
         { publicGateways: [1, 2, 3], use_data: false },
         {
           data: {
             name: "management",
           },
-          craig: craig,
+          craig: state,
         }
       );
-      let expectedData = {
-        cos: "cos",
-        bucket: "management-bucket",
-        name: "management",
-        resource_group: "management-rg",
-        classic_access: false,
-        manual_address_prefix_management: true,
-        default_network_acl_name: null,
-        default_security_group_name: null,
-        default_routing_table_name: null,
-        use_data: false,
-        publicGateways: [1, 2, 3],
-        address_prefixes: [
-          {
-            vpc: "management",
-            zone: 1,
-            name: "management-zone-1",
-            cidr: "10.10.0.0/22",
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            name: "management-zone-2",
-            cidr: "10.20.0.0/22",
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            name: "management-zone-3",
-            cidr: "10.30.0.0/22",
-          },
-        ],
-        subnets: [
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.0.0/29",
-            name: "vsi-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.0.16/29",
-            name: "vpn-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.0.0/29",
-            name: "vsi-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.0.0/29",
-            name: "vsi-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.0.32/29",
-            name: "vpe-zone-1",
-            resource_group: "management-rg",
-            network_acl: "management",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.0.16/29",
-            name: "vpe-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.0.16/29",
-            name: "vpe-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: false,
-          },
-        ],
-        public_gateways: [
+      assert.deepEqual(
+        state.store.json.vpcs[0].public_gateways,
+        [
           {
             zone: 1,
             vpc: "management",
@@ -359,750 +254,165 @@ describe("vpcs", () => {
             resource_group: "management-rg",
           },
         ],
-        acls: [
-          {
-            resource_group: "management-rg",
-            name: "management",
-            vpc: "management",
-            rules: [
-              {
-                action: "allow",
-                destination: "10.0.0.0/8",
-                direction: "inbound",
-                name: "allow-ibm-inbound",
-                source: "161.26.0.0/16",
-                acl: "management",
-                vpc: "management",
-                icmp: {
-                  type: null,
-                  code: null,
-                },
-                tcp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                udp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-                type: null,
-                code: null,
-                ruleProtocol: "all",
-              },
-              {
-                action: "allow",
-                source: "10.0.0.0/8",
-                direction: "outbound",
-                name: "allow-ibm-outbound",
-                destination: "161.26.0.0/16",
-                acl: "management",
-                vpc: "management",
-                icmp: {
-                  type: null,
-                  code: null,
-                },
-                tcp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                udp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-                type: null,
-                code: null,
-                ruleProtocol: "all",
-              },
-              {
-                action: "allow",
-                destination: "10.0.0.0/8",
-                direction: "inbound",
-                name: "allow-all-network-inbound",
-                source: "10.0.0.0/8",
-                acl: "management",
-                vpc: "management",
-                icmp: {
-                  type: null,
-                  code: null,
-                },
-                tcp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                udp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-                type: null,
-                code: null,
-                ruleProtocol: "all",
-              },
-              {
-                action: "allow",
-                destination: "10.0.0.0/8",
-                direction: "outbound",
-                name: "allow-all-network-outbound",
-                source: "10.0.0.0/8",
-                acl: "management",
-                vpc: "management",
-                icmp: {
-                  type: null,
-                  code: null,
-                },
-                tcp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                udp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-                type: null,
-                code: null,
-                ruleProtocol: "all",
-              },
-            ],
-            use_data: true,
-          },
-        ],
-      };
-      assert.deepEqual(
-        craig.store.json.vpcs[0],
-        expectedData,
         "it should return correct data"
       );
     });
     it("should update pgw and subnet rg on rg name change", () => {
-      let craig = newState();
-      craig.resource_groups.save(
+      state.resource_groups.save(
         { name: "frog" },
-        { data: { name: "management-rg" }, craig: craig }
+        { data: { name: "management-rg" }, craig: state }
       );
-      craig.vpcs.save(
+      state.vpcs.save(
         { publicGateways: [1, 2, 3] },
         {
           data: {
             name: "management",
           },
-          craig: craig,
+          craig: state,
         }
       );
+      assert.deepEqual(
+        state.store.json.vpcs[0].resource_group,
+        "frog",
+        "it should return correct data"
+      );
+      assert.deepEqual(
+        state.store.json.vpcs[0].subnets[0].resource_group,
+        "frog",
+        "it should return correct data"
+      );
+      assert.deepEqual(
+        state.store.json.vpcs[0].public_gateways[0].resource_group,
+        "frog",
+        "it should return correct data"
+      );
+    });
+    it("should disable bucket when use data", () => {
+      let state = newState();
+      state.vpcs.save(
+        { use_data: true },
+        {
+          data: state.store.json.vpcs[0],
+          craig: state,
+        }
+      );
+      assert.deepEqual(
+        state.store.json.vpcs[0].bucket,
+        "$disabled",
+        "it should be disabled"
+      );
+    });
+  });
+  describe("vpcs.create", () => {
+    it("should create a new vpc with a name and resource group", () => {
+      state.store.json._options.dynamic_subnets = false;
+      state.vpcs.create({ name: "test" });
       let expectedData = {
-        cos: "cos",
-        bucket: "management-bucket",
-        name: "management",
-        resource_group: "frog",
-        use_data: false,
+        cos: null,
+        bucket: null,
+        name: "test",
+        resource_group: null,
         classic_access: false,
-        manual_address_prefix_management: true,
+        manual_address_prefix_management: false,
         default_network_acl_name: null,
         default_security_group_name: null,
         default_routing_table_name: null,
-        publicGateways: [1, 2, 3],
-        address_prefixes: [
-          {
-            vpc: "management",
-            zone: 1,
-            name: "management-zone-1",
-            cidr: "10.10.0.0/22",
+        address_prefixes: [],
+        subnets: [],
+        public_gateways: [],
+        publicGateways: [],
+        acls: [],
+        subnetTiers: [],
+        use_data: false,
+      };
+      let actualData = state.store.json.vpcs[2];
+      assert.deepEqual(actualData, expectedData, "it should create new vpc");
+    });
+  });
+  describe("vpcs.delete", () => {
+    it("should delete a vpc from config", () => {
+      state.store.json._options.dynamic_subnets = false;
+      state.vpcs.delete({}, { data: { name: "management" } });
+      assert.deepEqual(
+        state.store.json.vpcs.length,
+        1,
+        "it should have only one vpcs"
+      );
+      assert.deepEqual(
+        state.store.json.vpcs[0].name,
+        "workload",
+        "it should have workload as the first vpc"
+      );
+    });
+  });
+  describe("vpcs.schema", () => {
+    let craig;
+    beforeEach(() => {
+      craig = newState();
+    });
+    it("should return true if vpc has a duplicate name", () => {
+      let actualData = craig.vpcs.name.invalid(
+        {
+          name: "test",
+        },
+        {
+          craig: {
+            store: {
+              json: {
+                vpcs: [
+                  {
+                    name: "test",
+                  },
+                  {
+                    name: "frog",
+                  },
+                ],
+              },
+            },
           },
-          {
-            vpc: "management",
-            zone: 2,
-            name: "management-zone-2",
-            cidr: "10.20.0.0/22",
+          data: {
+            name: "frog",
           },
-          {
-            vpc: "management",
-            zone: 3,
-            name: "management-zone-3",
-            cidr: "10.30.0.0/22",
+        }
+      );
+      assert.isTrue(actualData, "it should be true");
+    });
+    it("should return true if vpc acl has a duplicate name", () => {
+      let actualData = craig.vpcs.default_network_acl_name.invalid(
+        {
+          name: "test2",
+          default_network_acl_name: "frog",
+        },
+        {
+          craig: {
+            store: {
+              json: {
+                vpcs: [
+                  {
+                    name: "test",
+                    acls: [],
+                  },
+                  {
+                    name: "frog",
+                    default_network_acl_name: "frog",
+                    acls: [],
+                  },
+                ],
+              },
+            },
           },
-        ],
-        subnets: [
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.0.0/29",
-            name: "vsi-zone-1",
-            network_acl: "management",
-            resource_group: "frog",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.0.16/29",
-            name: "vpn-zone-1",
-            network_acl: "management",
-            resource_group: "frog",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.0.0/29",
-            name: "vsi-zone-2",
-            network_acl: "management",
-            resource_group: "frog",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.0.0/29",
-            name: "vsi-zone-3",
-            network_acl: "management",
-            resource_group: "frog",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.0.32/29",
-            name: "vpe-zone-1",
-            resource_group: "frog",
-            network_acl: "management",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.0.16/29",
-            name: "vpe-zone-2",
-            network_acl: "management",
-            resource_group: "frog",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.0.16/29",
-            name: "vpe-zone-3",
-            network_acl: "management",
-            resource_group: "frog",
-            public_gateway: false,
-            has_prefix: false,
-          },
-        ],
-        public_gateways: [
-          {
-            zone: 1,
-            vpc: "management",
-            resource_group: "frog",
-          },
-          {
-            zone: 2,
-            vpc: "management",
-            resource_group: "frog",
-          },
-          {
-            zone: 3,
-            vpc: "management",
-            resource_group: "frog",
-          },
-        ],
-        acls: [
-          {
-            resource_group: "frog",
-            name: "management",
-            vpc: "management",
-            use_data: false,
-            rules: [
-              {
-                action: "allow",
-                destination: "10.0.0.0/8",
-                direction: "inbound",
-                name: "allow-ibm-inbound",
-                source: "161.26.0.0/16",
-                acl: "management",
-                vpc: "management",
-                icmp: {
-                  type: null,
-                  code: null,
-                },
-                tcp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                udp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-                type: null,
-                code: null,
-                ruleProtocol: "all",
-              },
-              {
-                action: "allow",
-                source: "10.0.0.0/8",
-                direction: "outbound",
-                name: "allow-ibm-outbound",
-                destination: "161.26.0.0/16",
-                acl: "management",
-                vpc: "management",
-                icmp: {
-                  type: null,
-                  code: null,
-                },
-                tcp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                udp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-                type: null,
-                code: null,
-                ruleProtocol: "all",
-              },
-              {
-                action: "allow",
-                destination: "10.0.0.0/8",
-                direction: "inbound",
-                name: "allow-all-network-inbound",
-                source: "10.0.0.0/8",
-                acl: "management",
-                vpc: "management",
-                icmp: {
-                  type: null,
-                  code: null,
-                },
-                tcp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                udp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-                type: null,
-                code: null,
-                ruleProtocol: "all",
-              },
-              {
-                action: "allow",
-                destination: "10.0.0.0/8",
-                direction: "outbound",
-                name: "allow-all-network-outbound",
-                source: "10.0.0.0/8",
-                acl: "management",
-                vpc: "management",
-                icmp: {
-                  type: null,
-                  code: null,
-                },
-                tcp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                udp: {
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                },
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-                type: null,
-                code: null,
-                ruleProtocol: "all",
-              },
-            ],
+          data: {
+            name: "frog",
           },
-        ],
-      };
-      assert.deepEqual(
-        craig.store.json.vpcs[0],
-        expectedData,
-        "it should return correct data"
-      );
-    });
-    it("should disable bucket when use data", () => {
-      let state = newState();
-      state.vpcs.save(
-        { use_data: true },
-        {
-          data: state.store.json.vpcs[0],
-          craig: state,
         }
       );
-      assert.deepEqual(
-        state.store.json.vpcs[0].bucket,
-        "$disabled",
-        "it should be disabled"
-      );
-    });
-  });
-  describe("vpcs.create", () => {
-    it("should create a new vpc with a name and resource group", () => {
-      let state = new newState();
-      state.store.json._options.dynamic_subnets = false;
-      state.vpcs.create({ name: "test" });
-      let expectedData = {
-        cos: null,
-        bucket: null,
-        name: "test",
-        resource_group: null,
-        classic_access: false,
-        manual_address_prefix_management: false,
-        default_network_acl_name: null,
-        default_security_group_name: null,
-        default_routing_table_name: null,
-        address_prefixes: [],
-        subnets: [],
-        public_gateways: [],
-        publicGateways: [],
-        acls: [],
-        subnetTiers: [],
-        use_data: false,
-      };
-      let actualData = state.store.json.vpcs[2];
-      assert.deepEqual(actualData, expectedData, "it should create new vpc");
-    });
-  });
-  describe("vpcs.delete", () => {
-    it("should delete a vpc from config", () => {
-      let state = new newState(true);
-      state.store.json._options.dynamic_subnets = false;
-      state.vpcs.delete({}, { data: { name: "management" } });
-      let expectedData = [
-        {
-          cos: "cos",
-          bucket: "workload-bucket",
-          name: "workload",
-          resource_group: "workload-rg",
-          classic_access: false,
-          manual_address_prefix_management: true,
-          default_network_acl_name: null,
-          default_security_group_name: null,
-          default_routing_table_name: null,
-          use_data: false,
-          address_prefixes: [
-            {
-              vpc: "workload",
-              zone: 1,
-              cidr: "10.40.10.0/24",
-              name: "vsi-zone-1",
-            },
-            {
-              vpc: "workload",
-              zone: 2,
-              cidr: "10.50.10.0/24",
-              name: "vsi-zone-2",
-            },
-            {
-              vpc: "workload",
-              zone: 3,
-              cidr: "10.60.10.0/24",
-              name: "vsi-zone-3",
-            },
-            {
-              vpc: "workload",
-              zone: 1,
-              cidr: "10.40.20.0/24",
-              name: "vpe-zone-1",
-            },
-            {
-              vpc: "workload",
-              zone: 2,
-              cidr: "10.50.20.0/24",
-              name: "vpe-zone-2",
-            },
-            {
-              vpc: "workload",
-              zone: 3,
-              cidr: "10.60.20.0/24",
-              name: "vpe-zone-3",
-            },
-          ],
-          subnets: [
-            {
-              vpc: "workload",
-              zone: 1,
-              cidr: "10.40.10.0/24",
-              name: "vsi-zone-1",
-              network_acl: "workload",
-              resource_group: "workload-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "workload",
-              zone: 2,
-              cidr: "10.50.10.0/24",
-              name: "vsi-zone-2",
-              network_acl: "workload",
-              resource_group: "workload-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "workload",
-              zone: 3,
-              cidr: "10.60.10.0/24",
-              name: "vsi-zone-3",
-              network_acl: "workload",
-              resource_group: "workload-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "workload",
-              zone: 1,
-              cidr: "10.40.20.0/24",
-              name: "vpe-zone-1",
-              network_acl: "workload",
-              resource_group: "workload-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "workload",
-              zone: 2,
-              cidr: "10.50.20.0/24",
-              name: "vpe-zone-2",
-              network_acl: "workload",
-              resource_group: "workload-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "workload",
-              zone: 3,
-              cidr: "10.60.20.0/24",
-              name: "vpe-zone-3",
-              network_acl: "workload",
-              resource_group: "workload-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-          ],
-          public_gateways: [],
-          publicGateways: [],
-          acls: [
-            {
-              use_data: false,
-              resource_group: "workload-rg",
-              name: "workload",
-              vpc: "workload",
-              rules: [
-                {
-                  action: "allow",
-                  destination: "10.0.0.0/8",
-                  direction: "inbound",
-                  name: "allow-ibm-inbound",
-                  source: "161.26.0.0/16",
-                  acl: "workload",
-                  vpc: "workload",
-                  icmp: {
-                    type: null,
-                    code: null,
-                  },
-                  tcp: {
-                    port_min: null,
-                    port_max: null,
-                    source_port_min: null,
-                    source_port_max: null,
-                  },
-                  udp: {
-                    port_min: null,
-                    port_max: null,
-                    source_port_min: null,
-                    source_port_max: null,
-                  },
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                  type: null,
-                  code: null,
-                  ruleProtocol: "all",
-                },
-                {
-                  action: "allow",
-                  source: "10.0.0.0/8",
-                  direction: "outbound",
-                  name: "allow-ibm-outbound",
-                  destination: "161.26.0.0/16",
-                  acl: "workload",
-                  vpc: "workload",
-                  icmp: {
-                    type: null,
-                    code: null,
-                  },
-                  tcp: {
-                    port_min: null,
-                    port_max: null,
-                    source_port_min: null,
-                    source_port_max: null,
-                  },
-                  udp: {
-                    port_min: null,
-                    port_max: null,
-                    source_port_min: null,
-                    source_port_max: null,
-                  },
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                  type: null,
-                  code: null,
-                  ruleProtocol: "all",
-                },
-                {
-                  action: "allow",
-                  destination: "10.0.0.0/8",
-                  direction: "inbound",
-                  name: "allow-all-network-inbound",
-                  source: "10.0.0.0/8",
-                  acl: "workload",
-                  vpc: "workload",
-                  icmp: {
-                    type: null,
-                    code: null,
-                  },
-                  tcp: {
-                    port_min: null,
-                    port_max: null,
-                    source_port_min: null,
-                    source_port_max: null,
-                  },
-                  udp: {
-                    port_min: null,
-                    port_max: null,
-                    source_port_min: null,
-                    source_port_max: null,
-                  },
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                  type: null,
-                  code: null,
-                  ruleProtocol: "all",
-                },
-                {
-                  action: "allow",
-                  destination: "10.0.0.0/8",
-                  direction: "outbound",
-                  name: "allow-all-network-outbound",
-                  source: "10.0.0.0/8",
-                  acl: "workload",
-                  vpc: "workload",
-                  icmp: {
-                    type: null,
-                    code: null,
-                  },
-                  tcp: {
-                    port_min: null,
-                    port_max: null,
-                    source_port_min: null,
-                    source_port_max: null,
-                  },
-                  udp: {
-                    port_min: null,
-                    port_max: null,
-                    source_port_min: null,
-                    source_port_max: null,
-                  },
-                  port_min: null,
-                  port_max: null,
-                  source_port_min: null,
-                  source_port_max: null,
-                  type: null,
-                  code: null,
-                  ruleProtocol: "all",
-                },
-              ],
-            },
-          ],
-        },
-      ];
-      assert.deepEqual(
-        state.store.json.vpcs,
-        expectedData,
-        "it should have only one vpcs"
-      );
-    });
-  });
-  describe("vpcs.schema", () => {
-    let craig;
-    beforeEach(() => {
-      craig = newState();
+      assert.isTrue(actualData, "it should be true");
     });
-    it("should return true if vpc has a duplicate name", () => {
-      let actualData = craig.vpcs.name.invalid(
+    it("should return true if vpc acl has a duplicate name with existing acl", () => {
+      let actualData = craig.vpcs.default_network_acl_name.invalid(
         {
-          name: "test",
+          name: "test2",
+          default_network_acl_name: "frog",
         },
         {
           craig: {
@@ -1111,71 +421,12 @@ describe("vpcs", () => {
                 vpcs: [
                   {
                     name: "test",
-                  },
-                  {
-                    name: "frog",
-                  },
-                ],
-              },
-            },
-          },
-          data: {
-            name: "frog",
-          },
-        }
-      );
-      assert.isTrue(actualData, "it should be true");
-    });
-    it("should return true if vpc acl has a duplicate name", () => {
-      let actualData = craig.vpcs.default_network_acl_name.invalid(
-        {
-          name: "test2",
-          default_network_acl_name: "frog",
-        },
-        {
-          craig: {
-            store: {
-              json: {
-                vpcs: [
-                  {
-                    name: "test",
-                    acls: [],
-                  },
-                  {
-                    name: "frog",
-                    default_network_acl_name: "frog",
-                    acls: [],
-                  },
-                ],
-              },
-            },
-          },
-          data: {
-            name: "frog",
-          },
-        }
-      );
-      assert.isTrue(actualData, "it should be true");
-    });
-    it("should return true if vpc acl has a duplicate name with existing acl", () => {
-      let actualData = craig.vpcs.default_network_acl_name.invalid(
-        {
-          name: "test2",
-          default_network_acl_name: "frog",
-        },
-        {
-          craig: {
-            store: {
-              json: {
-                vpcs: [
-                  {
-                    name: "test",
-                    default_network_acl_name: "egg",
-                    acls: [
-                      {
-                        name: "frog",
-                      },
-                    ],
+                    default_network_acl_name: "egg",
+                    acls: [
+                      {
+                        name: "frog",
+                      },
+                    ],
                   },
                   {
                     name: "frog",
@@ -1649,7 +900,6 @@ describe("vpcs", () => {
   describe("vpcs.subnets", () => {
     describe("vpcs.subnets.save", () => {
       it("should update a subnet in place", () => {
-        let state = new newState();
         state.vpcs.subnets.save(
           {
             name: "frog",
@@ -1666,7 +916,6 @@ describe("vpcs", () => {
         );
       });
       it("should update a subnet in place", () => {
-        let state = new newState(true);
         state.store.json._options.dynamic_subnets = false;
         state.vpcs.subnets.save(
           {
@@ -1685,7 +934,6 @@ describe("vpcs", () => {
         );
       });
       it("should update a subnet in place", () => {
-        let state = new newState(true);
         state.store.json._options.dynamic_subnets = false;
         state.vpcs.subnets.save(
           {
@@ -1824,50 +1072,6 @@ describe("vpcs", () => {
       it("should update an advanced subnet in place when no matching prefix", () => {
         let state = new newState(true);
         state.store.json._options.dynamic_subnets = false;
-        let expectedPrefixes = [
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.10.0/24",
-            name: "vsi-zone-1",
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.10.0/24",
-            name: "vsi-zone-2",
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.10.0/24",
-            name: "vsi-zone-3",
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.20.0/24",
-            name: "vpe-zone-1",
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.20.0/24",
-            name: "vpe-zone-2",
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.20.0/24",
-            name: "vpe-zone-3",
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "1.2.3.4/5",
-            name: "frog",
-          },
-        ];
         state.vpcs.subnetTiers.save(
           {
             advanced: true,
@@ -2160,71 +1364,9 @@ describe("vpcs", () => {
             },
           }
         );
-        let expectedData = [
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.10.0/24",
-            name: "vsi-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.10.0/24",
-            name: "vsi-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.10.0/24",
-            name: "vsi-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.20.0/24",
-            name: "vpe-zone-1",
-            resource_group: "management-rg",
-            network_acl: "management",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.20.0/24",
-            name: "vpe-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.20.0/24",
-            name: "vpe-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-        ];
         assert.deepEqual(
-          state.store.json.vpcs[0].subnets,
-          expectedData,
+          state.store.json.vpcs[0].subnets.length,
+          6,
           "vpn-zone-1 should be deleted"
         );
       });
@@ -2361,68 +1503,6 @@ describe("vpcs", () => {
       it("should update a subnet tier in place", () => {
         let vpcState = newState(true);
         vpcState.store.json._options.dynamic_subnets = false;
-        let expectedData = [
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.10.0/24",
-            name: "frog-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.30.0/24",
-            name: "vpn-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.10.0/24",
-            name: "frog-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.20.0/24",
-            name: "vpe-zone-1",
-            resource_group: "management-rg",
-            network_acl: "management",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.20.0/24",
-            name: "vpe-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.20.0/24",
-            name: "vpe-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-        ];
         vpcState.store.json.dns.push({
           name: "dns",
           zones: [],
@@ -2455,9 +1535,20 @@ describe("vpcs", () => {
             },
           }
         );
-        assert.deepEqual(
-          vpcState.store.json.vpcs[0].subnets,
-          expectedData,
+        assert.isFalse(
+          splatContains(
+            vpcState.store.json.vpcs[0].subnets,
+            "name",
+            "vsi-zone-1"
+          ),
+          "it should change subnets"
+        );
+        assert.isTrue(
+          splatContains(
+            vpcState.store.json.vpcs[0].subnets,
+            "name",
+            "frog-zone-2"
+          ),
           "it should change subnets"
         );
         assert.deepEqual(
@@ -2539,70 +1630,9 @@ describe("vpcs", () => {
       it("should update a subnet tier in place with nacl and gateway", () => {
         let vpcState = newState(true);
         vpcState.store.json._options.dynamic_subnets = false;
+        vpcState.store.json.vpcs[0].publicGateways = [1, 2, 3];
         vpcState.vpcs.acls.create({ name: "todd" }, { vpc_name: "management" });
-        let expectedData = [
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.10.0/24",
-            name: "frog-zone-1",
-            network_acl: "todd",
-            resource_group: "management-rg",
-            public_gateway: true,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.30.0/24",
-            name: "vpn-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.10.0/24",
-            name: "frog-zone-2",
-            network_acl: "todd",
-            resource_group: "management-rg",
-            public_gateway: true,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.20.0/24",
-            name: "vpe-zone-1",
-            resource_group: "management-rg",
-            network_acl: "management",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.20.0/24",
-            name: "vpe-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.20.0/24",
-            name: "vpe-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-        ];
-        vpcState.vpcs.subnetTiers.save(
+        vpcState.vpcs.subnetTiers.save(
           {
             name: "frog",
             zones: 2,
@@ -2641,76 +1671,38 @@ describe("vpcs", () => {
           }
         );
         assert.deepEqual(
-          vpcState.store.json.vpcs[0].subnets,
-          expectedData,
-          "it should change subnets"
-        );
-      });
-      it("should update a subnet tier in place with nacl and gateway when only one gateway is enabled", () => {
-        let vpcState = newState();
-        vpcState.vpcs.acls.create({ name: "todd" }, { vpc_name: "management" });
-        let expectedData = [
+          vpcState.store.json.vpcs[0].subnets[0],
           {
             vpc: "management",
             zone: 1,
-            cidr: "10.10.0.0/29",
+            cidr: "10.10.10.0/24",
             name: "frog-zone-1",
             network_acl: "todd",
             resource_group: "management-rg",
             public_gateway: true,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.0.16/28",
-            name: "vpn-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: false,
+            has_prefix: true,
           },
+          "it should change subnets"
+        );
+        assert.deepEqual(
+          vpcState.store.json.vpcs[0].subnets[2],
           {
             vpc: "management",
             zone: 2,
-            cidr: "10.20.0.0/29",
+            cidr: "10.20.10.0/24",
             name: "frog-zone-2",
             network_acl: "todd",
             resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.0.48/29",
-            name: "vpe-zone-1",
-            resource_group: "management-rg",
-            network_acl: "management",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.0.16/29",
-            name: "vpe-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: false,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.0.0/29",
-            name: "vpe-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: false,
+            public_gateway: true,
+            has_prefix: true,
           },
-        ];
+          "it should change subnets"
+        );
+      });
+      it("should update a subnet tier in place with nacl and gateway when only one gateway is enabled", () => {
+        let vpcState = newState();
+        vpcState.vpcs.acls.create({ name: "todd" }, { vpc_name: "management" });
+        vpcState.store.json.vpcs[0].publicGateways = [1];
         vpcState.vpcs.subnetTiers.save(
           {
             name: "frog",
@@ -2742,96 +1734,37 @@ describe("vpcs", () => {
           }
         );
         assert.deepEqual(
-          vpcState.store.json.vpcs[0].subnets,
-          expectedData,
-          "it should change subnets"
-        );
-      });
-      it("should update a subnet tier in place with additional zones and with no acl", () => {
-        let vpcState = newState(true);
-        vpcState.store.json._options.dynamic_subnets = false;
-        let expectedData = [
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.10.0/24",
-            name: "vsi-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.30.0/24",
-            name: "vpn-zone-1",
-            network_acl: null,
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.10.0/24",
-            name: "vsi-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.10.0/24",
-            name: "vsi-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
+          vpcState.store.json.vpcs[0].subnets[0],
           {
             vpc: "management",
             zone: 1,
-            cidr: "10.10.20.0/24",
-            name: "vpe-zone-1",
-            resource_group: "management-rg",
-            network_acl: "management",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.20.0/24",
-            name: "vpe-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.20.0/24",
-            name: "vpe-zone-3",
-            network_acl: "management",
+            cidr: "10.10.0.0/29",
+            name: "frog-zone-1",
+            network_acl: "todd",
             resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
+            public_gateway: true,
+            has_prefix: false,
           },
+          "it should change subnets"
+        );
+        assert.deepEqual(
+          vpcState.store.json.vpcs[0].subnets[2],
           {
             vpc: "management",
             zone: 2,
-            cidr: "10.20.30.0/24",
-            name: "vpn-zone-2",
-            network_acl: null,
+            cidr: "10.20.0.0/29",
+            name: "frog-zone-2",
+            network_acl: "todd",
             resource_group: "management-rg",
             public_gateway: false,
-            has_prefix: true,
+            has_prefix: false,
           },
-        ];
+          "it should change subnets"
+        );
+      });
+      it("should update a subnet tier in place with additional zones and with no acl", () => {
+        let vpcState = newState(true);
+        vpcState.store.json._options.dynamic_subnets = false;
         vpcState.vpcs.subnetTiers.save(
           {
             name: "vpn",
@@ -2855,9 +1788,20 @@ describe("vpcs", () => {
             },
           }
         );
-        assert.deepEqual(
-          vpcState.store.json.vpcs[0].subnets,
-          expectedData,
+        assert.isTrue(
+          splatContains(
+            vpcState.store.json.vpcs[0].subnets,
+            "name",
+            "vpn-zone-1"
+          ),
+          "it should change subnets"
+        );
+        assert.isTrue(
+          splatContains(
+            vpcState.store.json.vpcs[0].subnets,
+            "name",
+            "vpn-zone-2"
+          ),
           "it should change subnets"
         );
       });
@@ -2946,6 +1890,7 @@ describe("vpcs", () => {
       it("should update a subnet tier in place with additional zones and with no acl and 1 zone pgw", () => {
         let vpcState = newState(true);
         vpcState.store.json._options.dynamic_subnets = false;
+        vpcState.store.json.vpcs[0].publicGateways = [1, 2, 3];
         let expectedData = [
           {
             vpc: "management",
@@ -3067,94 +2012,13 @@ describe("vpcs", () => {
       it("should update a subnet tier in place with additional zones and with no acl and 2 zone pgw", () => {
         let vpcState = newState(true);
         vpcState.store.json._options.dynamic_subnets = false;
-        let expectedData = [
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.10.0/24",
-            name: "vsi-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
+        vpcState.store.json.vpcs[0].publicGateways = [2, 3];
+        vpcState.vpcs.subnetTiers.save(
           {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.30.0/24",
-            name: "vpn-zone-1",
-            network_acl: null,
-            resource_group: "management-rg",
-            public_gateway: true,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.10.0/24",
-            name: "vsi-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.10.0/24",
-            name: "vsi-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.20.0/24",
-            name: "vpe-zone-1",
-            resource_group: "management-rg",
-            network_acl: "management",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.20.0/24",
-            name: "vpe-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.20.0/24",
-            name: "vpe-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.30.0/24",
-            name: "vpn-zone-2",
-            network_acl: null,
-            resource_group: "management-rg",
-            public_gateway: true,
-            has_prefix: true,
-          },
-        ];
-        vpcState.vpcs.subnetTiers.save(
-          {
-            name: "vpn",
-            zones: 2,
-            networkAcl: "",
-            addPublicGateway: true,
+            name: "vpn",
+            zones: 2,
+            networkAcl: "",
+            addPublicGateway: true,
           },
           {
             vpc_name: "management",
@@ -3183,117 +2047,18 @@ describe("vpcs", () => {
             },
           }
         );
-        assert.deepEqual(
-          vpcState.store.json.vpcs[0].subnets,
-          expectedData,
-          "it should change subnets"
+        assert.isTrue(
+          vpcState.store.json.vpcs[0].subnets[7].public_gateway,
+          "it should have public gateway"
+        );
+        assert.isFalse(
+          vpcState.store.json.vpcs[0].subnets[2].public_gateway,
+          "it should not have public gateway"
         );
       });
       it("should expand a reserved edge subnet tier in place with additional zones", () => {
         let vpcState = newState(true);
         vpcState.store.json._options.dynamic_subnets = false;
-        let expectedData = [
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.10.0/24",
-            name: "vsi-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.30.0/24",
-            name: "vpn-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.10.0/24",
-            name: "vsi-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.10.0/24",
-            name: "vsi-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.20.0/24",
-            name: "vpe-zone-1",
-            resource_group: "management-rg",
-            network_acl: "management",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.20.0/24",
-            name: "vpe-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.20.0/24",
-            name: "vpe-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.5.60.0/24",
-            name: "f5-bastion-zone-1",
-            network_acl: null,
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.6.60.0/24",
-            name: "f5-bastion-zone-2",
-            network_acl: null,
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.7.60.0/24",
-            name: "f5-bastion-zone-3",
-            network_acl: null,
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-        ];
         vpcState.store.edge_vpc_name = "management";
         vpcState.store.subnetTiers.management.unshift({
           name: "f5-bastion",
@@ -3331,9 +2096,20 @@ describe("vpcs", () => {
             },
           }
         );
-        assert.deepEqual(
-          vpcState.store.json.vpcs[0].subnets,
-          expectedData,
+        assert.isTrue(
+          splatContains(
+            vpcState.store.json.vpcs[0].subnets,
+            "name",
+            "f5-bastion-zone-2"
+          ),
+          "it should change subnets"
+        );
+        assert.isTrue(
+          splatContains(
+            vpcState.store.json.vpcs[0].subnets,
+            "name",
+            "f5-bastion-zone-3"
+          ),
           "it should change subnets"
         );
       });
@@ -4371,6 +3147,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
           ];
           craig.store.json.dns.push({
@@ -4548,6 +3325,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
           ];
           craig.store.json.vpcs[0].publicGateways = [1, 2];
@@ -4641,6 +3419,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
           ];
           craig.store.json.vpcs[0].publicGateways = [1];
@@ -4741,6 +3520,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
             {
               vpc: "management",
@@ -4929,6 +3709,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
             {
               vpc: "management",
@@ -5039,6 +3820,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
             {
               vpc: "management",
@@ -5150,6 +3932,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
             {
               vpc: "management",
@@ -5274,6 +4057,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
           ];
           craig.store.json.dns.push({
@@ -5450,6 +4234,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
           ];
           craig.store.json.dns.push({
@@ -5626,6 +4411,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
           ];
           craig.vpcs.subnetTiers.save(
@@ -5905,6 +4691,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
           ];
           craig.vpcs.subnetTiers.save(
@@ -6055,6 +4842,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
           ];
           craig.store.json.f5_vsi = [
@@ -6436,6 +5224,7 @@ describe("vpcs", () => {
               resource_group: "management-rg",
               use_data: true,
               vpc: "management",
+              public_gateway: false,
             },
             {
               cidr: "10.20.30.0/24",
@@ -6499,71 +5288,224 @@ describe("vpcs", () => {
             "it should change subnets"
           );
         });
-      });
-    });
-    describe("vpcs.subnetTiers.create", () => {
-      it("should add a subnet tier to vpc", () => {
-        let vpcState = new newState(true);
-        vpcState.store.json._options.dynamic_subnets = false;
-        vpcState.vpcs.subnetTiers.create(
-          {
-            name: "test",
-            zones: 3,
-            networkAcl: "management",
-          },
-          { vpc_name: "management" }
-        );
-        let expectedData = [
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.10.0/24",
-            name: "vsi-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.30.0/24",
-            name: "vpn-zone-1",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 2,
-            cidr: "10.20.10.0/24",
-            name: "vsi-zone-2",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 3,
-            cidr: "10.30.10.0/24",
-            name: "vsi-zone-3",
-            network_acl: "management",
-            resource_group: "management-rg",
-            public_gateway: false,
-            has_prefix: true,
-          },
-          {
-            vpc: "management",
-            zone: 1,
-            cidr: "10.10.20.0/24",
-            name: "vpe-zone-1",
-            resource_group: "management-rg",
-            network_acl: "management",
-            public_gateway: false,
-            has_prefix: true,
-          },
+        it("should update pgw when removing from vpc", () => {
+          let expectedData = [
+            {
+              vpc: "management",
+              zone: 1,
+              cidr: "10.10.10.0/24",
+              name: "vsi-zone-1",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
+            },
+            {
+              vpc: "management",
+              zone: 1,
+              cidr: "10.10.30.0/24",
+              name: "vpn-zone-1",
+              network_acl: null,
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
+            },
+            {
+              vpc: "management",
+              zone: 2,
+              cidr: "10.20.10.0/24",
+              name: "vsi-zone-2",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
+            },
+            {
+              vpc: "management",
+              zone: 3,
+              cidr: "10.30.10.0/24",
+              name: "vsi-zone-3",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
+            },
+            {
+              vpc: "management",
+              zone: 1,
+              cidr: "10.10.20.0/24",
+              name: "vpe-zone-1",
+              resource_group: "management-rg",
+              network_acl: "management",
+              public_gateway: false,
+              has_prefix: true,
+            },
+            {
+              vpc: "management",
+              zone: 2,
+              cidr: "10.20.20.0/24",
+              name: "vpe-zone-2",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
+            },
+            {
+              vpc: "management",
+              zone: 3,
+              cidr: "10.30.20.0/24",
+              name: "vpe-zone-3",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
+            },
+            {
+              name: "test",
+              network_acl: null,
+              resource_group: "management-rg",
+              use_data: true,
+              vpc: "management",
+              public_gateway: false,
+            },
+            {
+              cidr: "10.20.30.0/24",
+              has_prefix: true,
+              name: "vpn-zone-2",
+              network_acl: null,
+              public_gateway: false,
+              resource_group: "management-rg",
+              vpc: "management",
+              zone: 2,
+            },
+            {
+              cidr: "10.30.30.0/24",
+              has_prefix: true,
+              name: "vpn-zone-3",
+              network_acl: null,
+              public_gateway: false,
+              resource_group: "management-rg",
+              vpc: "management",
+              zone: 3,
+            },
+          ];
+          craig.store.json.vpcs[0].publicGateways = [1, 2, 3];
+          craig.vpcs.subnetTiers.save(
+            {
+              name: "vpn",
+              zones: "3",
+              networkAcl: "",
+              addPublicGateway: true,
+              select_zones: "3",
+              advanced: false,
+            },
+            {
+              vpc_name: "management",
+              data: {
+                hide: true,
+                networkAcl: "transit",
+                addPublicGateway: false,
+                name: "vpn",
+                zones: "1",
+                advanced: false,
+                select_zones: "3",
+              },
+              craig: {
+                store: {
+                  json: {
+                    vpcs: [
+                      {
+                        name: "management",
+                        publicGateways: [],
+                      },
+                    ],
+                  },
+                },
+              },
+            }
+          );
+          craig.vpcs.save(
+            {
+              publicGateways: [],
+            },
+            {
+              data: {
+                name: "management",
+              },
+              craig: craig,
+            }
+          );
+          assert.deepEqual(
+            craig.store.json.vpcs[0].subnets,
+            expectedData,
+            "it should change subnets"
+          );
+        });
+      });
+    });
+    describe("vpcs.subnetTiers.create", () => {
+      it("should add a subnet tier to vpc", () => {
+        let vpcState = new newState(true);
+        vpcState.store.json._options.dynamic_subnets = false;
+        vpcState.vpcs.subnetTiers.create(
+          {
+            name: "test",
+            zones: 3,
+            networkAcl: "management",
+          },
+          { vpc_name: "management" }
+        );
+        let expectedData = [
+          {
+            vpc: "management",
+            zone: 1,
+            cidr: "10.10.10.0/24",
+            name: "vsi-zone-1",
+            network_acl: "management",
+            resource_group: "management-rg",
+            public_gateway: false,
+            has_prefix: true,
+          },
+          {
+            vpc: "management",
+            zone: 1,
+            cidr: "10.10.30.0/24",
+            name: "vpn-zone-1",
+            network_acl: "management",
+            resource_group: "management-rg",
+            public_gateway: false,
+            has_prefix: true,
+          },
+          {
+            vpc: "management",
+            zone: 2,
+            cidr: "10.20.10.0/24",
+            name: "vsi-zone-2",
+            network_acl: "management",
+            resource_group: "management-rg",
+            public_gateway: false,
+            has_prefix: true,
+          },
+          {
+            vpc: "management",
+            zone: 3,
+            cidr: "10.30.10.0/24",
+            name: "vsi-zone-3",
+            network_acl: "management",
+            resource_group: "management-rg",
+            public_gateway: false,
+            has_prefix: true,
+          },
+          {
+            vpc: "management",
+            zone: 1,
+            cidr: "10.10.20.0/24",
+            name: "vpe-zone-1",
+            resource_group: "management-rg",
+            network_acl: "management",
+            public_gateway: false,
+            has_prefix: true,
+          },
           {
             vpc: "management",
             zone: 2,
@@ -6624,6 +5566,7 @@ describe("vpcs", () => {
       it("should add a subnet tier to vpc with pgw", () => {
         let vpcState = new newState(true);
         vpcState.store.json._options.dynamic_subnets = false;
+        vpcState.store.json.vpcs[0].publicGateways = [1, 2, 3];
         vpcState.vpcs.subnetTiers.create(
           {
             name: "test",
@@ -7208,6 +6151,7 @@ describe("vpcs", () => {
           );
         });
         it("should add a subnet tier to vpc with pgw", () => {
+          craig.store.json.vpcs[0].publicGateways = [1, 2, 3];
           craig.vpcs.subnetTiers.create(
             {
               name: "test",
@@ -8035,665 +6979,33 @@ describe("vpcs", () => {
                 },
               },
             },
-          }
-        );
-        vpcState.vpcs.subnetTiers.delete(
-          { advanced: true },
-          { vpc_name: "management", data: { name: "vsi", advanced: true } }
-        );
-        assert.deepEqual(
-          vpcState.store.json.vpcs[0].subnets,
-          expectedData,
-          "it should change subnets"
-        );
-      });
-      describe("vpc.subnetTiers.delete (from JSON)", () => {
-        let craig;
-        beforeEach(() => {
-          craig = new newState(true);
-          craig.store.json._options.dynamic_subnets = false;
-          craig.hardSetJson(craig.store.json, true);
-        });
-        it("should delete a subnet tier", () => {
-          let expectedData = [
-            {
-              vpc: "management",
-              zone: 1,
-              cidr: "10.10.10.0/24",
-              name: "vpn-zone-1",
-              network_acl: "management",
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "management",
-              zone: 1,
-              cidr: "10.10.20.0/24",
-              name: "vpe-zone-1",
-              resource_group: "management-rg",
-              network_acl: "management",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "management",
-              zone: 2,
-              cidr: "10.20.20.0/24",
-              name: "vpe-zone-2",
-              network_acl: "management",
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "management",
-              zone: 3,
-              cidr: "10.30.20.0/24",
-              name: "vpe-zone-3",
-              network_acl: "management",
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-          ];
-          craig.vpcs.subnetTiers.delete(
-            {},
-            { vpc_name: "management", data: { name: "vsi" } }
-          );
-          assert.deepEqual(
-            craig.store.json.vpcs[0].subnets,
-            expectedData,
-            "it should change subnets"
-          );
-          assert.deepEqual(craig.store.json.vpcs[0].subnetTiers, [
-            {
-              name: "vpn",
-              zones: 1,
-            },
-            {
-              name: "vpe",
-              zones: 3,
-            },
-          ]);
-        });
-        it("should delete a subnet tier and update address prefixes", () => {
-          let expectedData = [
-            {
-              vpc: "management",
-              zone: 1,
-              cidr: "10.10.20.0/24",
-              name: "vpe-zone-1",
-            },
-            {
-              vpc: "management",
-              zone: 2,
-              cidr: "10.20.20.0/24",
-              name: "vpe-zone-2",
-            },
-            {
-              vpc: "management",
-              zone: 3,
-              cidr: "10.30.20.0/24",
-              name: "vpe-zone-3",
-            },
-            {
-              vpc: "management",
-              zone: 1,
-              cidr: "10.10.10.0/24",
-              name: "vpn-zone-1",
-            },
-          ];
-          craig.vpcs.subnetTiers.delete(
-            {},
-            { vpc_name: "management", data: { name: "vsi" } }
-          );
-          assert.deepEqual(
-            craig.store.json.vpcs[0].address_prefixes,
-            expectedData,
-            "it should change subnets"
-          );
-        });
-        it("should delete a subnet tier and leave F5 subnets in place", () => {
-          // push f5-management to subnets
-          craig.store.json.vpcs[0].subnets.push({
-            cidr: "10.5.60.0/24",
-            has_prefix: true,
-            name: "f5-bastion-zone-1",
-            network_acl: "management",
-            public_gateway: false,
-            resource_group: "edge-rg",
-            vpc: "edge",
-            zone: 1,
-          });
-          craig.store.json.vpcs[0].subnets.push({
-            cidr: "10.6.60.0/24",
-            has_prefix: true,
-            name: "f5-bastion-zone-2",
-            network_acl: "management",
-            public_gateway: false,
-            resource_group: "edge-rg",
-            vpc: "edge",
-            zone: 2,
-          });
-          craig.store.json.vpcs[0].subnets.push({
-            cidr: "10.7.60.0/24",
-            has_prefix: true,
-            name: "f5-bastion-zone-3",
-            network_acl: "management",
-            public_gateway: false,
-            resource_group: "edge-rg",
-            vpc: "edge",
-            zone: 3,
-          });
-          let expectedData = [
-            {
-              vpc: "management",
-              zone: 1,
-              cidr: "10.10.10.0/24",
-              name: "vpn-zone-1",
-              network_acl: "management",
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "management",
-              zone: 1,
-              cidr: "10.10.20.0/24",
-              name: "vpe-zone-1",
-              resource_group: "management-rg",
-              network_acl: "management",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "management",
-              zone: 2,
-              cidr: "10.20.20.0/24",
-              name: "vpe-zone-2",
-              network_acl: "management",
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "management",
-              zone: 3,
-              cidr: "10.30.20.0/24",
-              name: "vpe-zone-3",
-              network_acl: "management",
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              cidr: "10.5.60.0/24",
-              has_prefix: true,
-              name: "f5-bastion-zone-1",
-              network_acl: "management",
-              public_gateway: false,
-              resource_group: "management-rg",
-              vpc: "management",
-              zone: 1,
-            },
-            {
-              cidr: "10.6.60.0/24",
-              has_prefix: true,
-              name: "f5-bastion-zone-2",
-              network_acl: "management",
-              public_gateway: false,
-              resource_group: "management-rg",
-              vpc: "management",
-              zone: 2,
-            },
-            {
-              cidr: "10.7.60.0/24",
-              has_prefix: true,
-              name: "f5-bastion-zone-3",
-              network_acl: "management",
-              public_gateway: false,
-              resource_group: "management-rg",
-              vpc: "management",
-              zone: 3,
-            },
-          ];
-          craig.vpcs.subnetTiers.delete(
-            { name: "vsi", zones: 3 },
-            { vpc_name: "management", data: { name: "vsi", zones: 3 } }
-          );
-          assert.deepEqual(
-            craig.store.json.vpcs[0].subnets,
-            expectedData,
-            "it should change subnets"
-          );
-        });
-        it("should delete an advanced subnet tier", () => {
-          let expectedData = [
-            {
-              vpc: "management",
-              zone: 1,
-              cidr: "10.10.10.0/24",
-              name: "vpn-zone-1",
-              network_acl: "management",
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "management",
-              zone: 1,
-              cidr: "10.10.20.0/24",
-              name: "vpe-zone-1",
-              resource_group: "management-rg",
-              network_acl: "management",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "management",
-              zone: 2,
-              cidr: "10.20.20.0/24",
-              name: "vpe-zone-2",
-              network_acl: "management",
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-            {
-              vpc: "management",
-              zone: 3,
-              cidr: "10.30.20.0/24",
-              name: "vpe-zone-3",
-              network_acl: "management",
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-          ];
-          craig.vpcs.subnetTiers.save(
-            {
-              name: "vsi",
-              select_zones: [1, 2],
-              advanced: true,
-              subnets: ["vsi-zone-1", "vsi-zone-2"],
-            },
-            {
-              vpc_name: "management",
-              data: { name: "vsi" },
-              craig: craig,
-            }
-          );
-          craig.vpcs.subnetTiers.delete(
-            { advanced: true, zones: 0 },
-            {
-              vpc_name: "management",
-              data: {
-                name: "vsi",
-                advanced: true,
-                subnets: ["vsi-zone-1", "vsi-zone-2"],
-              },
-            }
-          );
-          assert.deepEqual(
-            craig.store.json.vpcs[0].subnets,
-            expectedData,
-            "it should change subnets"
-          );
-        });
-      });
-    });
-    describe("vpcs.subnetTiers.schema", () => {
-      let craig;
-      beforeEach(() => {
-        craig = newState();
-      });
-      it("should return true when name invalid", () => {
-        let actualData = craig.vpcs.subnetTiers.name.invalidText(
-          { name: "@@@" },
-          {
-            vpc_name: "test",
-            craig: {
-              store: {
-                subnetTiers: {
-                  test: [
-                    {
-                      name: "frog",
-                    },
-                  ],
-                },
-              },
-            },
-          }
-        );
-        let expectedData =
-          "Name must follow the regex pattern: /^[A-z]([a-z0-9-]*[a-z0-9])*$/s";
-        assert.deepEqual(
-          actualData,
-          expectedData,
-          "it should return correct data"
-        );
-      });
-      it("should return true when name duplicate", () => {
-        let actualData = craig.vpcs.subnetTiers.name.invalidText(
-          { name: "frog" },
-          {
-            vpc_name: "test",
-            craig: {
-              store: {
-                subnetTiers: {
-                  test: [
-                    {
-                      name: "frog",
-                    },
-                  ],
-                },
-              },
-            },
-          }
-        );
-        let expectedData = 'Name "frog" already in use';
-        assert.deepEqual(
-          actualData,
-          expectedData,
-          "it should return correct data"
-        );
-      });
-      it("should disable advanced toggle when dynamic subnets", () => {
-        assert.isTrue(
-          craig.vpcs.subnetTiers.advanced.disabled({}, { craig: craig }),
-          "it should be disabled"
-        );
-      });
-      it("should disable advanced toggle when advanced", () => {
-        craig.store.json._options.dynamic_subnets = false;
-        assert.isTrue(
-          craig.vpcs.subnetTiers.advanced.disabled(
-            { vpc: "vpc", name: "vpn-2" },
-            { craig: craig, data: { advanced: true } }
-          ),
-          "it should be disabled"
-        );
-      });
-      it("should disable advanced toggle when not advanced", () => {
-        craig.store.json._options.dynamic_subnets = false;
-        assert.isFalse(
-          craig.vpcs.subnetTiers.advanced.disabled(
-            { vpc: "vpc", name: "vpn-2" },
-            { craig: craig, data: { advanced: false } }
-          ),
-          "it should be disabled"
-        );
-      });
-      it("should disable advanced toggle when dedicated edge tier", () => {
-        craig.store.edge_vpc_name = "vpc";
-        assert.isTrue(
-          craig.vpcs.subnetTiers.advanced.disabled(
-            { vpc: "vpc", name: "vpn-2" },
-            { craig: craig, data: { advanced: false } }
-          ),
-          "it should be disabled"
-        );
-      });
-      it("should show zones as multiselect when advanced", () => {
-        assert.deepEqual(
-          craig.vpcs.subnetTiers.zones.type({ advanced: true }),
-          "multiselect",
-          "it should have correct type"
-        );
-      });
-      it("should show zones as multiselect when nor advanced", () => {
-        assert.deepEqual(
-          craig.vpcs.subnetTiers.zones.type({}),
-          "select",
-          "it should have correct type"
-        );
-      });
-      it("should change zones to array when advanced", () => {
-        assert.deepEqual(
-          craig.vpcs.subnetTiers.zones.onRender({ advanced: true, zones: "3" }),
-          ["1", "2", "3"],
-          "it should return zones"
-        );
-      });
-      it("should change zones to array when advanced", () => {
-        assert.deepEqual(
-          craig.vpcs.subnetTiers.zones.onRender({ advanced: true, zones: "1" }),
-          ["1"],
-          "it should return zones"
-        );
-      });
-      it("should change zones to array when advanced", () => {
-        assert.deepEqual(
-          craig.vpcs.subnetTiers.zones.onRender({
-            advanced: true,
-            zones: "3",
-            select_zones: ["2", "3"],
-          }),
-          ["2", "3"],
-          "it should return zones"
-        );
-      });
-      it("should not change zones when already advanced", () => {
-        assert.deepEqual(
-          craig.vpcs.subnetTiers.zones.onRender({
-            advanced: true,
-            zones: ["3"],
-          }),
-          ["3"],
-          "it should return zones"
-        );
-      });
-      it("should be disabled when state data is advanced and component props is not", () => {
-        assert.isTrue(
-          craig.vpcs.subnetTiers.zones.disabled(
-            {
-              advanced: true,
-              zones: ["3"],
-            },
-            {
-              data: {
-                advanced: false,
-              },
-            }
-          ),
-          "it should return zones"
-        );
-      });
-      it("should reset zones to component props zones when changing state data.advanced to true", () => {
-        let data = {
-          zones: 3,
-        };
-        craig.vpcs.subnetTiers.advanced.onInputChange(
-          data,
-          {},
-          { data: { zones: 2 } }
-        );
-        assert.deepEqual(data.zones, 2, "it should reset zones");
-      });
-      it("should change zones to string when not advanced", () => {
-        assert.deepEqual(
-          craig.vpcs.subnetTiers.zones.onRender({
-            advanced: false,
-            zones: ["1", "2", "3"],
-          }),
-          "3",
-          "it should return zones"
-        );
-      });
-      it("should disable advanced toggle when not dynamic subnets but is advanced", () => {
-        assert.isTrue(
-          craig.vpcs.subnetTiers.advanced.disabled(
-            {},
-            {
-              craig: {
-                store: {
-                  json: {
-                    _options: {
-                      dynamic_subnets: false,
-                    },
-                  },
-                },
-              },
-              data: {
-                advanced: true,
-              },
-            }
-          ),
-          "it should be disabled"
-        );
-      });
-      it("should get correct groups for vpc network acl", () => {
-        assert.deepEqual(
-          craig.vpcs.subnetTiers.networkAcl.groups(
-            {},
-            { craig: craig, vpc_name: "management" }
-          ),
-          ["management"],
-          "it should return list of acls"
-        );
-      });
-      it("should disable network acl when advanced", () => {
-        assert.isTrue(
-          craig.vpcs.subnetTiers.networkAcl.disabled({ advanced: true }),
-          "it should be disabled"
-        );
-      });
-      it("should read only network acl when dedicated edge tier", () => {
-        craig.store.edge_vpc_name = "vpc";
-        assert.isTrue(
-          craig.vpcs.subnetTiers.networkAcl.readOnly(
-            { name: "vpn-2", vpc: "vpc" },
-            { craig: craig }
-          ),
-          "it should be read only"
-        );
-      });
-      it("should show network acl as invalid when in modal and no acl selected", () => {
-        assert.isTrue(
-          craig.vpcs.subnetTiers.networkAcl.invalid({}, { isModal: true }),
-          "it should be invalid"
-        );
-      });
-      it("should disable add public gateway when advanced", () => {
-        assert.isTrue(
-          craig.vpcs.subnetTiers.addPublicGateway.disabled({ advanced: true }),
-          "it should be disabled"
-        );
-      });
-      it("should disable add public gateway when dedicated edge tier", () => {
-        craig.store.edge_vpc_name = "vpc";
-        assert.isTrue(
-          craig.vpcs.subnetTiers.addPublicGateway.disabled(
-            { name: "vpn-2", vpc: "vpc" },
-            { craig: craig }
-          ),
-          "it should be disabled"
-        );
-      });
-      it("should disable add public gateway toggle when no gateways", () => {
-        assert.isTrue(
-          craig.vpcs.subnetTiers.addPublicGateway.disabled(
-            { name: "hi" },
-            { craig: craig, vpc: "management" }
-          ),
-          "it should be disabled"
-        );
-      });
-    });
-  });
-  describe("vpcs.network_acls", () => {
-    describe("vpcs.network_acls.create", () => {
-      it("should create an acl", () => {
-        let state = newState();
-        state.vpcs.acls.create({ name: "new" }, { vpc_name: "management" });
-        let expectedData = {
-          name: "new",
-          resource_group: "management-rg",
-          vpc: "management",
-          rules: [],
-          use_data: false,
-        };
-        assert.deepEqual(
-          state.store.json.vpcs[0].acls[1],
-          expectedData,
-          "it should create acl"
-        );
-      });
-      it("should create an acl with rg", () => {
-        let state = newState();
-        state.store.json.vpcs[0].resource_group = null;
-        state.vpcs.acls.create(
-          { name: "new", resource_group: "workload-rg" },
-          { vpc_name: "management" }
-        );
-        let expectedData = {
-          name: "new",
-          resource_group: "workload-rg",
-          vpc: "management",
-          rules: [],
-          use_data: false,
-        };
-        assert.deepEqual(
-          state.store.json.vpcs[0].acls[1],
-          expectedData,
-          "it should create acl"
-        );
-      });
-      it("should create an acl and update rg when deleted", () => {
-        let state = newState();
-        state.vpcs.acls.create({ name: "new" }, { vpc_name: "management" });
-        state.resource_groups.delete({}, { data: { name: "management-rg" } });
-        let expectedData = {
-          name: "new",
-          resource_group: null,
-          vpc: "management",
-          rules: [],
-          use_data: false,
-        };
-        assert.deepEqual(
-          state.store.json.vpcs[0].acls[1],
-          expectedData,
-          "it should create acl"
+          }
         );
-      });
-    });
-    describe("vpcs.network_acls.delete", () => {
-      it("should delete an acl", () => {
-        let state = newState();
-        state.vpcs.acls.delete(
-          {},
-          { data: { name: "management" }, vpc_name: "management" }
+        vpcState.vpcs.subnetTiers.delete(
+          { advanced: true },
+          { vpc_name: "management", data: { name: "vsi", advanced: true } }
         );
-        let expectedData = [];
         assert.deepEqual(
-          state.store.json.vpcs[0].acls,
+          vpcState.store.json.vpcs[0].subnets,
           expectedData,
-          "it should delete acl"
+          "it should change subnets"
         );
       });
-      it("should set subnet acls to null on delete", () => {
-        let state = newState(true);
-        state.store.json._options.dynamic_subnets = false;
-        state.vpcs.acls.delete(
-          {},
-          { data: { name: "management" }, vpc_name: "management" }
-        );
-        let expectedData = [];
-        assert.deepEqual(
-          state.store.json.vpcs[0].acls,
-          expectedData,
-          "it should delete acl"
-        );
-        assert.deepEqual(
-          state.store.json.vpcs[0].subnets,
-          [
+      describe("vpc.subnetTiers.delete (from JSON)", () => {
+        let craig;
+        beforeEach(() => {
+          craig = new newState(true);
+          craig.store.json._options.dynamic_subnets = false;
+          craig.hardSetJson(craig.store.json, true);
+        });
+        it("should delete a subnet tier", () => {
+          let expectedData = [
             {
               vpc: "management",
               zone: 1,
               cidr: "10.10.10.0/24",
-              name: "vsi-zone-1",
-              network_acl: null,
+              name: "vpn-zone-1",
+              network_acl: "management",
               resource_group: "management-rg",
               public_gateway: false,
               has_prefix: true,
@@ -8701,19 +7013,19 @@ describe("vpcs", () => {
             {
               vpc: "management",
               zone: 1,
-              cidr: "10.10.30.0/24",
-              name: "vpn-zone-1",
-              network_acl: null,
+              cidr: "10.10.20.0/24",
+              name: "vpe-zone-1",
               resource_group: "management-rg",
+              network_acl: "management",
               public_gateway: false,
               has_prefix: true,
             },
             {
               vpc: "management",
               zone: 2,
-              cidr: "10.20.10.0/24",
-              name: "vsi-zone-2",
-              network_acl: null,
+              cidr: "10.20.20.0/24",
+              name: "vpe-zone-2",
+              network_acl: "management",
               resource_group: "management-rg",
               public_gateway: false,
               has_prefix: true,
@@ -8721,1198 +7033,516 @@ describe("vpcs", () => {
             {
               vpc: "management",
               zone: 3,
-              cidr: "10.30.10.0/24",
-              name: "vsi-zone-3",
-              network_acl: null,
+              cidr: "10.30.20.0/24",
+              name: "vpe-zone-3",
+              network_acl: "management",
               resource_group: "management-rg",
               public_gateway: false,
               has_prefix: true,
             },
+          ];
+          craig.vpcs.subnetTiers.delete(
+            {},
+            { vpc_name: "management", data: { name: "vsi" } }
+          );
+          assert.deepEqual(
+            craig.store.json.vpcs[0].subnets,
+            expectedData,
+            "it should change subnets"
+          );
+          assert.deepEqual(craig.store.json.vpcs[0].subnetTiers, [
+            {
+              name: "vpn",
+              zones: 1,
+            },
+            {
+              name: "vpe",
+              zones: 3,
+            },
+          ]);
+        });
+        it("should delete a subnet tier and update address prefixes", () => {
+          let expectedData = [
             {
               vpc: "management",
               zone: 1,
               cidr: "10.10.20.0/24",
               name: "vpe-zone-1",
-              resource_group: "management-rg",
-              network_acl: null,
-              public_gateway: false,
-              has_prefix: true,
             },
             {
               vpc: "management",
               zone: 2,
               cidr: "10.20.20.0/24",
               name: "vpe-zone-2",
-              network_acl: null,
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
             },
             {
               vpc: "management",
               zone: 3,
               cidr: "10.30.20.0/24",
               name: "vpe-zone-3",
-              network_acl: null,
-              resource_group: "management-rg",
-              public_gateway: false,
-              has_prefix: true,
-            },
-          ],
-          "it should have correct subnets"
-        );
-      });
-    });
-    describe("vpcs.network_acls.save", () => {
-      it("should update an acl", () => {
-        let state = newState();
-        // control for unchanged acls
-        state.store.json.vpcs[0].subnets[1].network_acl = "frog";
-        state.vpcs.acls.save(
-          { name: "new" },
-          { data: { name: "management" }, vpc_name: "management" }
-        );
-        assert.deepEqual(
-          state.store.json.vpcs[0].acls[0].name,
-          "new",
-          "it should update acl"
-        );
-        assert.deepEqual(
-          state.store.json.vpcs[0].acls[0].rules[0].acl,
-          "new",
-          "it should have correct acl"
-        );
-        assert.deepEqual(
-          state.store.json.vpcs[0].subnets[0].network_acl,
-          "new",
-          "it should have correct acl"
-        );
-      });
-      it("should update an acl with no name change", () => {
-        let state = newState();
-        state.vpcs.acls.save(
-          { name: "management", resource_group: "workload-rg" },
-          { data: { name: "management" }, vpc_name: "management" }
-        );
-        assert.deepEqual(
-          state.store.json.vpcs[0].acls[0].resource_group,
-          "workload-rg",
-          "it should update acl rg"
-        );
-      });
-    });
-    describe("vpcs.network_acls.rules", () => {
-      describe("vpcs.network_acls.rules.create", () => {
-        it("should create a network acl rule", () => {
-          let state = newState();
-          state.vpcs.acls.rules.create(
-            {
-              name: "frog",
-              action: "allow",
-              direction: "inbound",
-              source: "8.8.8.8",
-              destination: "0.0.0.0/0",
-            },
-            {
-              vpc_name: "management",
-              parent_name: "management",
-            }
-          );
-          let expectedData = [
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              destination: "10.0.0.0/8",
-              direction: "inbound",
-              name: "allow-ibm-inbound",
-              source: "161.26.0.0/16",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              action: "allow",
-              source: "10.0.0.0/8",
-              direction: "outbound",
-              name: "allow-ibm-outbound",
-              destination: "161.26.0.0/16",
-              acl: "management",
-              vpc: "management",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              destination: "10.0.0.0/8",
-              direction: "inbound",
-              name: "allow-all-network-inbound",
-              source: "10.0.0.0/8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              destination: "10.0.0.0/8",
-              direction: "outbound",
-              name: "allow-all-network-outbound",
-              source: "10.0.0.0/8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
             },
             {
-              acl: "management",
               vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "0.0.0.0/0",
-              name: "frog",
-              source: "8.8.8.8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
+              zone: 1,
+              cidr: "10.10.10.0/24",
+              name: "vpn-zone-1",
             },
           ];
+          craig.vpcs.subnetTiers.delete(
+            {},
+            { vpc_name: "management", data: { name: "vsi" } }
+          );
           assert.deepEqual(
-            state.store.json.vpcs[0].acls[0].rules,
+            craig.store.json.vpcs[0].address_prefixes,
             expectedData,
-            "it should add rule"
+            "it should change subnets"
           );
         });
-        it("should create a network acl rule with deny outbound", () => {
-          let state = newState();
-          state.vpcs.acls.rules.create(
-            {
-              name: "frog",
-              action: "deny",
-              direction: "outbound",
-              source: "8.8.8.8",
-              destination: "0.0.0.0/0",
-            },
-            {
-              vpc_name: "management",
-              parent_name: "management",
-            }
-          );
+        it("should delete a subnet tier and leave F5 subnets in place", () => {
+          // push f5-management to subnets
+          craig.store.json.vpcs[0].subnets.push({
+            cidr: "10.5.60.0/24",
+            has_prefix: true,
+            name: "f5-bastion-zone-1",
+            network_acl: "management",
+            public_gateway: false,
+            resource_group: "edge-rg",
+            vpc: "edge",
+            zone: 1,
+          });
+          craig.store.json.vpcs[0].subnets.push({
+            cidr: "10.6.60.0/24",
+            has_prefix: true,
+            name: "f5-bastion-zone-2",
+            network_acl: "management",
+            public_gateway: false,
+            resource_group: "edge-rg",
+            vpc: "edge",
+            zone: 2,
+          });
+          craig.store.json.vpcs[0].subnets.push({
+            cidr: "10.7.60.0/24",
+            has_prefix: true,
+            name: "f5-bastion-zone-3",
+            network_acl: "management",
+            public_gateway: false,
+            resource_group: "edge-rg",
+            vpc: "edge",
+            zone: 3,
+          });
           let expectedData = [
             {
-              acl: "management",
               vpc: "management",
-              action: "allow",
-              destination: "10.0.0.0/8",
-              direction: "inbound",
-              name: "allow-ibm-inbound",
-              source: "161.26.0.0/16",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              action: "allow",
-              source: "10.0.0.0/8",
-              direction: "outbound",
-              name: "allow-ibm-outbound",
-              destination: "161.26.0.0/16",
-              acl: "management",
-              vpc: "management",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              destination: "10.0.0.0/8",
-              direction: "inbound",
-              name: "allow-all-network-inbound",
-              source: "10.0.0.0/8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              destination: "10.0.0.0/8",
-              direction: "outbound",
-              name: "allow-all-network-outbound",
-              source: "10.0.0.0/8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
+              zone: 1,
+              cidr: "10.10.10.0/24",
+              name: "vpn-zone-1",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
             },
             {
-              acl: "management",
               vpc: "management",
-              action: "deny",
-              direction: "outbound",
-              destination: "0.0.0.0/0",
-              name: "frog",
-              source: "8.8.8.8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
+              zone: 1,
+              cidr: "10.10.20.0/24",
+              name: "vpe-zone-1",
+              resource_group: "management-rg",
+              network_acl: "management",
+              public_gateway: false,
+              has_prefix: true,
             },
-          ];
-          assert.deepEqual(
-            state.store.json.vpcs[0].acls[0].rules,
-            expectedData,
-            "it should add rule"
-          );
-        });
-      });
-      describe("vpcs.network_acls.rules.save", () => {
-        it("should update a rule in place with all", () => {
-          let state = newState();
-          state.vpcs.acls.rules.save(
             {
-              name: "frog",
-              allow: false,
-              inbound: true,
-              source: "1.2.3.4",
-              destination: "5.6.7.8",
-              ruleProtocol: "all",
+              vpc: "management",
+              zone: 2,
+              cidr: "10.20.20.0/24",
+              name: "vpe-zone-2",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
             },
             {
-              vpc_name: "management",
-              parent_name: "management",
-              data: { name: "allow-all-network-outbound" },
-            }
-          );
-          let expectedData = [
+              vpc: "management",
+              zone: 3,
+              cidr: "10.30.20.0/24",
+              name: "vpe-zone-3",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
+            },
             {
-              acl: "management",
+              cidr: "10.5.60.0/24",
+              has_prefix: true,
+              name: "f5-bastion-zone-1",
+              network_acl: "management",
+              public_gateway: false,
+              resource_group: "management-rg",
               vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "10.0.0.0/8",
-              name: "allow-ibm-inbound",
-              source: "161.26.0.0/16",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              action: "allow",
-              source: "10.0.0.0/8",
-              direction: "outbound",
-              name: "allow-ibm-outbound",
-              destination: "161.26.0.0/16",
-              acl: "management",
-              vpc: "management",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "10.0.0.0/8",
-              name: "allow-all-network-inbound",
-              source: "10.0.0.0/8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
+              zone: 1,
+            },
+            {
+              cidr: "10.6.60.0/24",
+              has_prefix: true,
+              name: "f5-bastion-zone-2",
+              network_acl: "management",
+              public_gateway: false,
+              resource_group: "management-rg",
+              vpc: "management",
+              zone: 2,
             },
             {
-              acl: "management",
+              cidr: "10.7.60.0/24",
+              has_prefix: true,
+              name: "f5-bastion-zone-3",
+              network_acl: "management",
+              public_gateway: false,
+              resource_group: "management-rg",
               vpc: "management",
-              action: "deny",
-              direction: "inbound",
-              destination: "5.6.7.8",
-              name: "frog",
-              source: "1.2.3.4",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
+              zone: 3,
             },
           ];
+          craig.vpcs.subnetTiers.delete(
+            { name: "vsi", zones: 3 },
+            { vpc_name: "management", data: { name: "vsi", zones: 3 } }
+          );
           assert.deepEqual(
-            state.store.json.vpcs[0].acls[0].rules,
+            craig.store.json.vpcs[0].subnets,
             expectedData,
-            "it should update rule"
+            "it should change subnets"
           );
         });
-        it("should update a rule in place with protocol", () => {
-          let state = newState();
-          state.vpcs.acls.rules.save(
+        it("should delete an advanced subnet tier", () => {
+          let expectedData = [
             {
-              name: "frog",
-              allow: false,
-              inbound: true,
-              source: "1.2.3.4",
-              destination: "5.6.7.8",
-              ruleProtocol: "tcp",
-              rule: {
-                port_max: 8080,
-                port_min: null,
-              },
-              port_max: 8080,
-              port_min: null,
+              vpc: "management",
+              zone: 1,
+              cidr: "10.10.10.0/24",
+              name: "vpn-zone-1",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
             },
             {
-              vpc_name: "management",
-              parent_name: "management",
-              data: { name: "allow-all-network-outbound" },
-            }
-          );
-          let expectedData = [
+              vpc: "management",
+              zone: 1,
+              cidr: "10.10.20.0/24",
+              name: "vpe-zone-1",
+              resource_group: "management-rg",
+              network_acl: "management",
+              public_gateway: false,
+              has_prefix: true,
+            },
             {
-              acl: "management",
               vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "10.0.0.0/8",
-              name: "allow-ibm-inbound",
-              source: "161.26.0.0/16",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              action: "allow",
-              source: "10.0.0.0/8",
-              direction: "outbound",
-              name: "allow-ibm-outbound",
-              destination: "161.26.0.0/16",
-              acl: "management",
-              vpc: "management",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "10.0.0.0/8",
-              name: "allow-all-network-inbound",
-              source: "10.0.0.0/8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
+              zone: 2,
+              cidr: "10.20.20.0/24",
+              name: "vpe-zone-2",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
             },
             {
-              acl: "management",
               vpc: "management",
-              action: "deny",
-              direction: "inbound",
-              destination: "5.6.7.8",
-              name: "frog",
-              source: "1.2.3.4",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: 1,
-                port_max: 8080,
-                source_port_min: 1,
-                source_port_max: 65535,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: 8080,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "tcp",
+              zone: 3,
+              cidr: "10.30.20.0/24",
+              name: "vpe-zone-3",
+              network_acl: "management",
+              resource_group: "management-rg",
+              public_gateway: false,
+              has_prefix: true,
             },
           ];
-          assert.deepEqual(
-            state.store.json.vpcs[0].acls[0].rules,
-            expectedData,
-            "it should update rule"
-          );
-        });
-        it("should update a rule in place with only one change protocol", () => {
-          let state = newState();
-          state.vpcs.acls.rules.save(
-            {
-              name: "allow-all-outbound",
-              allow: true,
-              inbound: false,
-              source: "10.0.0.0/8",
-              destination: "0.0.0.0/0",
-              ruleProtocol: "tcp",
-              rule: {
-                port_max: 8080,
-                port_min: null,
-              },
+          craig.vpcs.subnetTiers.save(
+            {
+              name: "vsi",
+              select_zones: [1, 2],
+              advanced: true,
+              subnets: ["vsi-zone-1", "vsi-zone-2"],
             },
             {
               vpc_name: "management",
-              parent_name: "management",
-              data: { name: "allow-all-network-outbound" },
+              data: { name: "vsi" },
+              craig: craig,
             }
           );
-          let expectedData = [
+          craig.vpcs.subnetTiers.delete(
+            { advanced: true, zones: 0 },
             {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "10.0.0.0/8",
-              name: "allow-ibm-inbound",
-              source: "161.26.0.0/16",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              action: "allow",
-              source: "10.0.0.0/8",
-              direction: "outbound",
-              name: "allow-ibm-outbound",
-              destination: "161.26.0.0/16",
-              acl: "management",
-              vpc: "management",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "10.0.0.0/8",
-              name: "allow-all-network-inbound",
-              source: "10.0.0.0/8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              direction: "outbound",
-              destination: "0.0.0.0/0",
-              name: "allow-all-outbound",
-              source: "10.0.0.0/8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: 1,
-                port_max: 8080,
-                source_port_min: 1,
-                source_port_max: 65535,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
+              vpc_name: "management",
+              data: {
+                name: "vsi",
+                advanced: true,
+                subnets: ["vsi-zone-1", "vsi-zone-2"],
               },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "tcp",
-            },
-          ];
+            }
+          );
           assert.deepEqual(
-            state.store.json.vpcs[0].acls[0].rules,
+            craig.store.json.vpcs[0].subnets,
             expectedData,
-            "it should update rule"
+            "it should change subnets"
           );
         });
-        it("should update a rule in place with protocol and change port values to numbers from string", () => {
-          let state = newState();
-          state.vpcs.acls.rules.save(
-            {
-              name: "frog",
-              allow: false,
-              inbound: true,
-              source: "1.2.3.4",
-              destination: "5.6.7.8",
-              ruleProtocol: "tcp",
-              rule: {
-                port_max: "8080",
-                port_min: null,
+      });
+    });
+    describe("vpcs.subnetTiers.schema", () => {
+      let craig;
+      beforeEach(() => {
+        craig = newState();
+      });
+      it("should return true when name invalid", () => {
+        let actualData = craig.vpcs.subnetTiers.name.invalidText(
+          { name: "@@@" },
+          {
+            vpc_name: "test",
+            craig: {
+              store: {
+                subnetTiers: {
+                  test: [
+                    {
+                      name: "frog",
+                    },
+                  ],
+                },
               },
             },
+          }
+        );
+        let expectedData =
+          "Name must follow the regex pattern: /^[A-z]([a-z0-9-]*[a-z0-9])*$/s";
+        assert.deepEqual(
+          actualData,
+          expectedData,
+          "it should return correct data"
+        );
+      });
+      it("should return true when name duplicate", () => {
+        let actualData = craig.vpcs.subnetTiers.name.invalidText(
+          { name: "frog" },
+          {
+            vpc_name: "test",
+            craig: {
+              store: {
+                subnetTiers: {
+                  test: [
+                    {
+                      name: "frog",
+                    },
+                  ],
+                },
+              },
+            },
+          }
+        );
+        let expectedData = 'Name "frog" already in use';
+        assert.deepEqual(
+          actualData,
+          expectedData,
+          "it should return correct data"
+        );
+      });
+      it("should disable advanced toggle when dynamic subnets", () => {
+        assert.isTrue(
+          craig.vpcs.subnetTiers.advanced.disabled({}, { craig: craig }),
+          "it should be disabled"
+        );
+      });
+      it("should disable advanced toggle when advanced", () => {
+        craig.store.json._options.dynamic_subnets = false;
+        assert.isTrue(
+          craig.vpcs.subnetTiers.advanced.disabled(
+            { vpc: "vpc", name: "vpn-2" },
+            { craig: craig, data: { advanced: true } }
+          ),
+          "it should be disabled"
+        );
+      });
+      it("should disable advanced toggle when not advanced", () => {
+        craig.store.json._options.dynamic_subnets = false;
+        assert.isFalse(
+          craig.vpcs.subnetTiers.advanced.disabled(
+            { vpc: "vpc", name: "vpn-2" },
+            { craig: craig, data: { advanced: false } }
+          ),
+          "it should be disabled"
+        );
+      });
+      it("should disable advanced toggle when dedicated edge tier", () => {
+        craig.store.edge_vpc_name = "vpc";
+        assert.isTrue(
+          craig.vpcs.subnetTiers.advanced.disabled(
+            { vpc: "vpc", name: "vpn-2" },
+            { craig: craig, data: { advanced: false } }
+          ),
+          "it should be disabled"
+        );
+      });
+      it("should show zones as multiselect when advanced", () => {
+        assert.deepEqual(
+          craig.vpcs.subnetTiers.zones.type({ advanced: true }),
+          "multiselect",
+          "it should have correct type"
+        );
+      });
+      it("should show zones as multiselect when nor advanced", () => {
+        assert.deepEqual(
+          craig.vpcs.subnetTiers.zones.type({}),
+          "select",
+          "it should have correct type"
+        );
+      });
+      it("should change zones to array when advanced", () => {
+        assert.deepEqual(
+          craig.vpcs.subnetTiers.zones.onRender({ advanced: true, zones: "3" }),
+          ["1", "2", "3"],
+          "it should return zones"
+        );
+      });
+      it("should change zones to array when advanced", () => {
+        assert.deepEqual(
+          craig.vpcs.subnetTiers.zones.onRender({ advanced: true, zones: "1" }),
+          ["1"],
+          "it should return zones"
+        );
+      });
+      it("should change zones to array when advanced", () => {
+        assert.deepEqual(
+          craig.vpcs.subnetTiers.zones.onRender({
+            advanced: true,
+            zones: "3",
+            select_zones: ["2", "3"],
+          }),
+          ["2", "3"],
+          "it should return zones"
+        );
+      });
+      it("should not change zones when already advanced", () => {
+        assert.deepEqual(
+          craig.vpcs.subnetTiers.zones.onRender({
+            advanced: true,
+            zones: ["3"],
+          }),
+          ["3"],
+          "it should return zones"
+        );
+      });
+      it("should be disabled when state data is advanced and component props is not", () => {
+        assert.isTrue(
+          craig.vpcs.subnetTiers.zones.disabled(
             {
-              vpc_name: "management",
-              parent_name: "management",
-              data: { name: "allow-all-network-outbound" },
-            }
-          );
-          let expectedData = [
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "10.0.0.0/8",
-              name: "allow-ibm-inbound",
-              source: "161.26.0.0/16",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              action: "allow",
-              source: "10.0.0.0/8",
-              direction: "outbound",
-              name: "allow-ibm-outbound",
-              destination: "161.26.0.0/16",
-              acl: "management",
-              vpc: "management",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "10.0.0.0/8",
-              name: "allow-all-network-inbound",
-              source: "10.0.0.0/8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
+              advanced: true,
+              zones: ["3"],
             },
             {
-              acl: "management",
-              vpc: "management",
-              action: "deny",
-              direction: "inbound",
-              destination: "5.6.7.8",
-              name: "frog",
-              source: "1.2.3.4",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: 1,
-                port_max: 8080,
-                source_port_min: 1,
-                source_port_max: 65535,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
+              data: {
+                advanced: false,
               },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "tcp",
-            },
-          ];
-          assert.deepEqual(
-            state.store.json.vpcs[0].acls[0].rules,
-            expectedData,
-            "it should update rule"
-          );
-        });
+            }
+          ),
+          "it should return zones"
+        );
+      });
+      it("should reset zones to component props zones when changing state data.advanced to true", () => {
+        let data = {
+          zones: 3,
+        };
+        craig.vpcs.subnetTiers.advanced.onInputChange(
+          data,
+          {},
+          { data: { zones: 2 } }
+        );
+        assert.deepEqual(data.zones, 2, "it should reset zones");
+      });
+      it("should change zones to string when not advanced", () => {
+        assert.deepEqual(
+          craig.vpcs.subnetTiers.zones.onRender({
+            advanced: false,
+            zones: ["1", "2", "3"],
+          }),
+          "3",
+          "it should return zones"
+        );
       });
-      describe("vpcs.network_acls.rules.delete", () => {
-        it("should delete an acl rule", () => {
-          let state = newState();
-          state.vpcs.acls.rules.delete(
+      it("should disable advanced toggle when not dynamic subnets but is advanced", () => {
+        assert.isTrue(
+          craig.vpcs.subnetTiers.advanced.disabled(
             {},
             {
-              vpc_name: "management",
-              parent_name: "management",
-              data: { name: "allow-all-network-outbound" },
-            }
-          );
-          let expectedData = [
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "10.0.0.0/8",
-              name: "allow-ibm-inbound",
-              source: "161.26.0.0/16",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              action: "allow",
-              source: "10.0.0.0/8",
-              direction: "outbound",
-              name: "allow-ibm-outbound",
-              destination: "161.26.0.0/16",
-              acl: "management",
-              vpc: "management",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
-              },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-            {
-              acl: "management",
-              vpc: "management",
-              action: "allow",
-              direction: "inbound",
-              destination: "10.0.0.0/8",
-              name: "allow-all-network-inbound",
-              source: "10.0.0.0/8",
-              icmp: {
-                type: null,
-                code: null,
-              },
-              tcp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
+              craig: {
+                store: {
+                  json: {
+                    _options: {
+                      dynamic_subnets: false,
+                    },
+                  },
+                },
               },
-              udp: {
-                port_min: null,
-                port_max: null,
-                source_port_min: null,
-                source_port_max: null,
+              data: {
+                advanced: true,
               },
-              port_min: null,
-              port_max: null,
-              source_port_min: null,
-              source_port_max: null,
-              type: null,
-              code: null,
-              ruleProtocol: "all",
-            },
-          ];
-          assert.deepEqual(
-            state.store.json.vpcs[0].acls[0].rules,
-            expectedData,
-            "it should add rule"
-          );
-        });
+            }
+          ),
+          "it should be disabled"
+        );
+      });
+      it("should get correct groups for vpc network acl", () => {
+        assert.deepEqual(
+          craig.vpcs.subnetTiers.networkAcl.groups(
+            {},
+            { craig: craig, vpc_name: "management" }
+          ),
+          ["management"],
+          "it should return list of acls"
+        );
+      });
+      it("should disable network acl when advanced", () => {
+        assert.isTrue(
+          craig.vpcs.subnetTiers.networkAcl.disabled({ advanced: true }),
+          "it should be disabled"
+        );
+      });
+      it("should read only network acl when dedicated edge tier", () => {
+        craig.store.edge_vpc_name = "vpc";
+        assert.isTrue(
+          craig.vpcs.subnetTiers.networkAcl.readOnly(
+            { name: "vpn-2", vpc: "vpc" },
+            { craig: craig }
+          ),
+          "it should be read only"
+        );
+      });
+      it("should show network acl as invalid when in modal and no acl selected", () => {
+        assert.isTrue(
+          craig.vpcs.subnetTiers.networkAcl.invalid({}, { isModal: true }),
+          "it should be invalid"
+        );
+      });
+      it("should disable add public gateway when advanced", () => {
+        assert.isTrue(
+          craig.vpcs.subnetTiers.addPublicGateway.disabled({ advanced: true }),
+          "it should be disabled"
+        );
+      });
+      it("should disable add public gateway when dedicated edge tier", () => {
+        craig.store.edge_vpc_name = "vpc";
+        assert.isTrue(
+          craig.vpcs.subnetTiers.addPublicGateway.disabled(
+            { name: "vpn-2", vpc: "vpc" },
+            { craig: craig }
+          ),
+          "it should be disabled"
+        );
+      });
+      it("should disable add public gateway toggle when no gateways", () => {
+        assert.isTrue(
+          craig.vpcs.subnetTiers.addPublicGateway.disabled(
+            { name: "hi" },
+            { craig: craig, vpc: "management" }
+          ),
+          "it should be disabled"
+        );
       });
     });
   });
@@ -10262,291 +7892,4 @@ describe("vpcs", () => {
       );
     });
   });
-  describe("acl shcema", () => {
-    let craig = newState();
-    it("should hide use data when vpc does not use data", () => {
-      assert.isTrue(
-        craig.vpcs.acls.use_data.hideWhen(
-          {},
-          {
-            vpc_name: "vpc",
-            craig: {
-              store: {
-                json: {
-                  _options: {
-                    prefix: "iac",
-                  },
-                  vpcs: [
-                    {
-                      name: "vpc",
-                    },
-                  ],
-                },
-              },
-            },
-          }
-        ),
-        "it should be hidden"
-      );
-    });
-    it("should return correct text", () => {
-      assert.deepEqual(
-        craig.vpcs.acls.name.helperText(
-          { name: "test" },
-          {
-            vpc_name: "vpc",
-            craig: {
-              store: {
-                json: {
-                  _options: {
-                    prefix: "iac",
-                  },
-                },
-              },
-            },
-          }
-        ),
-        "iac-vpc-test-acl",
-        "it should return correct text"
-      );
-    });
-    it("should return correct text when use data", () => {
-      assert.deepEqual(
-        craig.vpcs.acls.name.helperText(
-          { name: "test", use_data: true },
-          {
-            vpc_name: "vpc",
-            craig: {
-              store: {
-                json: {
-                  _options: {
-                    prefix: "iac",
-                  },
-                },
-              },
-            },
-          }
-        ),
-        "test",
-        "it should return correct text"
-      );
-    });
-    it("should set data when changing rule protocol", () => {
-      let data = { ruleProtocol: "all" };
-      craig.vpcs.acls.rules.ruleProtocol.onInputChange(data);
-      assert.deepEqual(
-        data,
-        {
-          rule: {
-            port_max: null,
-            port_min: null,
-            source_port_max: null,
-            source_port_min: null,
-            type: null,
-            code: null,
-          },
-          ruleProtocol: "all",
-          tcp: {
-            port_min: null,
-            port_max: null,
-            source_port_max: null,
-            source_port_min: null,
-          },
-          udp: {
-            port_min: null,
-            source_port_max: null,
-            source_port_min: null,
-            port_max: null,
-          },
-          icmp: {
-            type: null,
-            code: null,
-          },
-        },
-        "it should return data"
-      );
-    });
-    it("should render value for each type when present on sub rule but not main", () => {
-      assert.deepEqual(
-        craig.vpcs.acls.rules.type.onRender({
-          icmp: {
-            type: "443",
-          },
-        }),
-        "443",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.type.onRender({
-          icmp: {
-            type: "null",
-          },
-        }),
-        "",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.type.onRender({
-          icmp: {
-            type: "null",
-          },
-          type: "1234",
-        }),
-        "1234",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.code.onRender({
-          icmp: {
-            code: "null",
-          },
-        }),
-        "",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.type.onRender({
-          icmp: {
-            type: null,
-          },
-          type: "443",
-        }),
-        "443",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.code.onRender({
-          icmp: {
-            code: "443",
-          },
-        }),
-        "443",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.code.onRender({
-          icmp: {},
-          code: "443",
-        }),
-        "443",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.port_max.onRender({
-          tcp: {
-            port_max: "443",
-          },
-        }),
-        "443",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.port_min.onRender({
-          tcp: {
-            port_min: "443",
-          },
-        }),
-        "443",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.source_port_max.onRender({
-          tcp: {
-            source_port_max: "443",
-          },
-        }),
-        "443",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.source_port_min.onRender({
-          tcp: {
-            source_port_min: "443",
-          },
-        }),
-        "443",
-        "it should set sub rule"
-      );
-      assert.deepEqual(
-        craig.vpcs.acls.rules.source_port_min.onRender({
-          tcp: {
-            source_port_min: null,
-          },
-          source_port_min: "443",
-        }),
-        "443",
-        "it should set sub rule"
-      );
-    });
-    it("should set rule data on input change", () => {
-      let data = {
-        ruleProtocol: "all",
-      };
-      craig.vpcs.acls.rules.ruleProtocol.onInputChange(data);
-      assert.deepEqual(
-        data,
-        {
-          rule: {
-            port_max: null,
-            port_min: null,
-            source_port_max: null,
-            source_port_min: null,
-            type: null,
-            code: null,
-          },
-          ruleProtocol: "all",
-          tcp: {
-            port_max: null,
-            port_min: null,
-            source_port_max: null,
-            source_port_min: null,
-          },
-          udp: {
-            port_max: null,
-            port_min: null,
-            source_port_max: null,
-            source_port_min: null,
-          },
-          icmp: {
-            type: null,
-            code: null,
-          },
-        },
-        "it should set rule"
-      );
-    });
-    it("should render all as rule protocol", () => {
-      assert.deepEqual(
-        "ALL",
-        craig.vpcs.acls.rules.ruleProtocol.onRender({ ruleProtocol: "all" }),
-        "it should return protocol"
-      );
-    });
-    it("should render TCP as rule protocol", () => {
-      assert.deepEqual(
-        "TCP",
-        craig.vpcs.acls.rules.ruleProtocol.onRender({ ruleProtocol: "tcp" }),
-        "it should return protocol"
-      );
-    });
-    it("should render empty string as rule protocol", () => {
-      assert.deepEqual(
-        "",
-        craig.vpcs.acls.rules.ruleProtocol.onRender({ ruleProtocol: "" }),
-        "it should return protocol"
-      );
-    });
-    it("should return invalid for object when no source", () => {
-      assert.isTrue(
-        craig.vpcs.acls.rules.source.invalid({}),
-        "it should be true"
-      );
-    });
-    it("should return invalid for object when no destination", () => {
-      assert.isTrue(
-        craig.vpcs.acls.rules.destination.invalid({}),
-        "it should be true"
-      );
-    });
-  });
 });
diff --git a/unit-tests/state/vpcs.acls.test.js b/unit-tests/state/vpcs.acls.test.js
new file mode 100644
index 00000000..965cc6c2
--- /dev/null
+++ b/unit-tests/state/vpcs.acls.test.js
@@ -0,0 +1,783 @@
+const { assert } = require("chai");
+const { state } = require("../../client/src/lib/state");
+const { splat, distinct, splatContains } = require("lazy-z");
+
+/**
+ * initialize store
+ * @param {boolean=} legacy
+ * @returns {lazyZState} state store
+ */
+function newState(legacy) {
+  let store = new state(legacy);
+  store.setUpdateCallback(() => {});
+  return store;
+}
+
+describe("vpc network acls", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
+  describe("vpcs.network_acls", () => {
+    describe("vpcs.network_acls.create", () => {
+      it("should create an acl", () => {
+        craig.vpcs.acls.create({ name: "new" }, { vpc_name: "management" });
+        let expectedData = {
+          name: "new",
+          resource_group: "management-rg",
+          vpc: "management",
+          rules: [],
+          use_data: false,
+        };
+        assert.deepEqual(
+          craig.store.json.vpcs[0].acls[1],
+          expectedData,
+          "it should create acl"
+        );
+      });
+      it("should create an acl with rg", () => {
+        craig.store.json.vpcs[0].resource_group = null;
+        craig.vpcs.acls.create(
+          { name: "new", resource_group: "workload-rg" },
+          { vpc_name: "management" }
+        );
+        let expectedData = {
+          name: "new",
+          resource_group: "workload-rg",
+          vpc: "management",
+          rules: [],
+          use_data: false,
+        };
+        assert.deepEqual(
+          craig.store.json.vpcs[0].acls[1],
+          expectedData,
+          "it should create acl"
+        );
+      });
+      it("should create an acl and update rg when deleted", () => {
+        craig.vpcs.acls.create({ name: "new" }, { vpc_name: "management" });
+        craig.resource_groups.delete({}, { data: { name: "management-rg" } });
+        let expectedData = {
+          name: "new",
+          resource_group: null,
+          vpc: "management",
+          rules: [],
+          use_data: false,
+        };
+        assert.deepEqual(
+          craig.store.json.vpcs[0].acls[1],
+          expectedData,
+          "it should create acl"
+        );
+      });
+    });
+    describe("vpcs.network_acls.delete", () => {
+      it("should delete an acl", () => {
+        craig.vpcs.acls.delete(
+          {},
+          { data: { name: "management" }, vpc_name: "management" }
+        );
+        let expectedData = [];
+        assert.deepEqual(
+          craig.store.json.vpcs[0].acls,
+          expectedData,
+          "it should delete acl"
+        );
+      });
+      it("should set subnet acls to null on delete", () => {
+        craig.store.json._options.dynamic_subnets = false;
+        craig.vpcs.acls.delete(
+          {},
+          { data: { name: "management" }, vpc_name: "management" }
+        );
+        let expectedData = [];
+        assert.deepEqual(
+          craig.store.json.vpcs[0].acls,
+          expectedData,
+          "it should delete acl"
+        );
+        assert.deepEqual(
+          distinct(splat(craig.store.json.vpcs[0].subnets, "network_acl")),
+          [null],
+          "it should have correct subnets"
+        );
+      });
+    });
+    describe("vpcs.network_acls.save", () => {
+      it("should update an acl", () => {
+        // control for unchanged acls
+        craig.store.json.vpcs[0].subnets[1].network_acl = "frog";
+        craig.vpcs.acls.save(
+          { name: "new" },
+          { data: { name: "management" }, vpc_name: "management" }
+        );
+        assert.deepEqual(
+          craig.store.json.vpcs[0].acls[0].name,
+          "new",
+          "it should update acl"
+        );
+        assert.deepEqual(
+          craig.store.json.vpcs[0].acls[0].rules[0].acl,
+          "new",
+          "it should have correct acl"
+        );
+        assert.deepEqual(
+          craig.store.json.vpcs[0].subnets[0].network_acl,
+          "new",
+          "it should have correct acl"
+        );
+      });
+      it("should update an acl with no name change", () => {
+        craig.vpcs.acls.save(
+          { name: "management", resource_group: "workload-rg" },
+          { data: { name: "management" }, vpc_name: "management" }
+        );
+        assert.deepEqual(
+          craig.store.json.vpcs[0].acls[0].resource_group,
+          "workload-rg",
+          "it should update acl rg"
+        );
+      });
+    });
+    describe("vpcs.network_acls.rules", () => {
+      describe("vpcs.network_acls.rules.create", () => {
+        it("should create a network acl rule", () => {
+          craig.vpcs.acls.rules.create(
+            {
+              name: "frog",
+              action: "allow",
+              direction: "inbound",
+              source: "8.8.8.8",
+              destination: "0.0.0.0/0",
+            },
+            {
+              vpc_name: "management",
+              parent_name: "management",
+            }
+          );
+
+          assert.deepEqual(
+            craig.store.json.vpcs[0].acls[0].rules[4],
+            {
+              acl: "management",
+              vpc: "management",
+              action: "allow",
+              direction: "inbound",
+              destination: "0.0.0.0/0",
+              name: "frog",
+              source: "8.8.8.8",
+              icmp: {
+                type: null,
+                code: null,
+              },
+              tcp: {
+                port_min: null,
+                port_max: null,
+                source_port_min: null,
+                source_port_max: null,
+              },
+              udp: {
+                port_min: null,
+                port_max: null,
+                source_port_min: null,
+                source_port_max: null,
+              },
+              port_min: null,
+              port_max: null,
+              source_port_min: null,
+              source_port_max: null,
+              type: null,
+              code: null,
+              ruleProtocol: "all",
+            },
+            "it should add rule"
+          );
+        });
+        it("should create a network acl rule with deny outbound", () => {
+          craig.vpcs.acls.rules.create(
+            {
+              name: "frog",
+              action: "deny",
+              direction: "outbound",
+              source: "8.8.8.8",
+              destination: "0.0.0.0/0",
+            },
+            {
+              vpc_name: "management",
+              parent_name: "management",
+            }
+          );
+          assert.deepEqual(
+            craig.store.json.vpcs[0].acls[0].rules[4],
+            {
+              acl: "management",
+              vpc: "management",
+              action: "deny",
+              direction: "outbound",
+              destination: "0.0.0.0/0",
+              name: "frog",
+              source: "8.8.8.8",
+              icmp: {
+                type: null,
+                code: null,
+              },
+              tcp: {
+                port_min: null,
+                port_max: null,
+                source_port_min: null,
+                source_port_max: null,
+              },
+              udp: {
+                port_min: null,
+                port_max: null,
+                source_port_min: null,
+                source_port_max: null,
+              },
+              port_min: null,
+              port_max: null,
+              source_port_min: null,
+              source_port_max: null,
+              type: null,
+              code: null,
+              ruleProtocol: "all",
+            },
+            "it should add rule"
+          );
+        });
+      });
+      describe("vpcs.network_acls.rules.save", () => {
+        it("should update a rule in place with all", () => {
+          craig.vpcs.acls.rules.save(
+            {
+              name: "frog",
+              allow: false,
+              inbound: true,
+              source: "1.2.3.4",
+              destination: "5.6.7.8",
+              ruleProtocol: "all",
+            },
+            {
+              vpc_name: "management",
+              parent_name: "management",
+              data: { name: "allow-all-network-outbound" },
+            }
+          );
+
+          assert.deepEqual(
+            craig.store.json.vpcs[0].acls[0].rules[3],
+            {
+              acl: "management",
+              vpc: "management",
+              action: "deny",
+              direction: "inbound",
+              destination: "5.6.7.8",
+              name: "frog",
+              source: "1.2.3.4",
+              icmp: {
+                type: null,
+                code: null,
+              },
+              tcp: {
+                port_min: null,
+                port_max: null,
+                source_port_min: null,
+                source_port_max: null,
+              },
+              udp: {
+                port_min: null,
+                port_max: null,
+                source_port_min: null,
+                source_port_max: null,
+              },
+              port_min: null,
+              port_max: null,
+              source_port_min: null,
+              source_port_max: null,
+              type: null,
+              code: null,
+              ruleProtocol: "all",
+            },
+            "it should update rule"
+          );
+        });
+        it("should update a rule in place with protocol", () => {
+          craig.vpcs.acls.rules.save(
+            {
+              name: "frog",
+              allow: false,
+              inbound: true,
+              source: "1.2.3.4",
+              destination: "5.6.7.8",
+              ruleProtocol: "tcp",
+              rule: {
+                port_max: 8080,
+                port_min: null,
+              },
+              port_max: 8080,
+              port_min: null,
+            },
+            {
+              vpc_name: "management",
+              parent_name: "management",
+              data: { name: "allow-all-network-outbound" },
+            }
+          );
+          assert.deepEqual(
+            craig.store.json.vpcs[0].acls[0].rules[3],
+            {
+              acl: "management",
+              vpc: "management",
+              action: "deny",
+              direction: "inbound",
+              destination: "5.6.7.8",
+              name: "frog",
+              source: "1.2.3.4",
+              icmp: {
+                type: null,
+                code: null,
+              },
+              tcp: {
+                port_min: 1,
+                port_max: 8080,
+                source_port_min: 1,
+                source_port_max: 65535,
+              },
+              udp: {
+                port_min: null,
+                port_max: null,
+                source_port_min: null,
+                source_port_max: null,
+              },
+              port_min: null,
+              port_max: 8080,
+              source_port_min: null,
+              source_port_max: null,
+              type: null,
+              code: null,
+              ruleProtocol: "tcp",
+            },
+            "it should update rule"
+          );
+        });
+        it("should update a rule in place with only one change protocol", () => {
+          craig.vpcs.acls.rules.save(
+            {
+              name: "allow-all-outbound",
+              allow: true,
+              inbound: false,
+              source: "10.0.0.0/8",
+              destination: "0.0.0.0/0",
+              ruleProtocol: "tcp",
+              rule: {
+                port_max: 8080,
+                port_min: null,
+              },
+            },
+            {
+              vpc_name: "management",
+              parent_name: "management",
+              data: { name: "allow-all-network-outbound" },
+            }
+          );
+
+          assert.deepEqual(
+            craig.store.json.vpcs[0].acls[0].rules[3],
+            {
+              acl: "management",
+              vpc: "management",
+              action: "allow",
+              direction: "outbound",
+              destination: "0.0.0.0/0",
+              name: "allow-all-outbound",
+              source: "10.0.0.0/8",
+              icmp: {
+                type: null,
+                code: null,
+              },
+              tcp: {
+                port_min: 1,
+                port_max: 8080,
+                source_port_min: 1,
+                source_port_max: 65535,
+              },
+              udp: {
+                port_min: null,
+                port_max: null,
+                source_port_min: null,
+                source_port_max: null,
+              },
+              port_min: null,
+              port_max: null,
+              source_port_min: null,
+              source_port_max: null,
+              type: null,
+              code: null,
+              ruleProtocol: "tcp",
+            },
+            "it should update rule"
+          );
+        });
+        it("should update a rule in place with protocol and change port values to numbers from string", () => {
+          craig.vpcs.acls.rules.save(
+            {
+              name: "frog",
+              allow: false,
+              inbound: true,
+              source: "1.2.3.4",
+              destination: "5.6.7.8",
+              ruleProtocol: "tcp",
+              rule: {
+                port_max: "8080",
+                port_min: null,
+              },
+            },
+            {
+              vpc_name: "management",
+              parent_name: "management",
+              data: { name: "allow-all-network-outbound" },
+            }
+          );
+          assert.deepEqual(
+            craig.store.json.vpcs[0].acls[0].rules[3],
+            {
+              acl: "management",
+              vpc: "management",
+              action: "deny",
+              direction: "inbound",
+              destination: "5.6.7.8",
+              name: "frog",
+              source: "1.2.3.4",
+              icmp: {
+                type: null,
+                code: null,
+              },
+              tcp: {
+                port_min: 1,
+                port_max: 8080,
+                source_port_min: 1,
+                source_port_max: 65535,
+              },
+              udp: {
+                port_min: null,
+                port_max: null,
+                source_port_min: null,
+                source_port_max: null,
+              },
+              port_min: null,
+              port_max: null,
+              source_port_min: null,
+              source_port_max: null,
+              type: null,
+              code: null,
+              ruleProtocol: "tcp",
+            },
+            "it should update rule"
+          );
+        });
+      });
+      describe("vpcs.network_acls.rules.delete", () => {
+        it("should delete an acl rule", () => {
+          craig.vpcs.acls.rules.delete(
+            {},
+            {
+              vpc_name: "management",
+              parent_name: "management",
+              data: { name: "allow-all-network-outbound" },
+            }
+          );
+          assert.deepEqual(
+            craig.store.json.vpcs[0].acls[0].rules.length,
+            3,
+            "it should add rule"
+          );
+        });
+      });
+    });
+  });
+  describe("acl shcema", () => {
+    it("should hide use data when vpc does not use data", () => {
+      assert.isTrue(
+        craig.vpcs.acls.use_data.hideWhen(
+          {},
+          {
+            vpc_name: "vpc",
+            craig: {
+              store: {
+                json: {
+                  _options: {
+                    prefix: "iac",
+                  },
+                  vpcs: [
+                    {
+                      name: "vpc",
+                    },
+                  ],
+                },
+              },
+            },
+          }
+        ),
+        "it should be hidden"
+      );
+    });
+    it("should return correct text", () => {
+      assert.deepEqual(
+        craig.vpcs.acls.name.helperText(
+          { name: "test" },
+          {
+            vpc_name: "vpc",
+            craig: {
+              store: {
+                json: {
+                  _options: {
+                    prefix: "iac",
+                  },
+                },
+              },
+            },
+          }
+        ),
+        "iac-vpc-test-acl",
+        "it should return correct text"
+      );
+    });
+    it("should return correct text when use data", () => {
+      assert.deepEqual(
+        craig.vpcs.acls.name.helperText(
+          { name: "test", use_data: true },
+          {
+            vpc_name: "vpc",
+            craig: {
+              store: {
+                json: {
+                  _options: {
+                    prefix: "iac",
+                  },
+                },
+              },
+            },
+          }
+        ),
+        "test",
+        "it should return correct text"
+      );
+    });
+    it("should set data when changing rule protocol", () => {
+      let data = { ruleProtocol: "all" };
+      craig.vpcs.acls.rules.ruleProtocol.onInputChange(data);
+      assert.deepEqual(
+        data,
+        {
+          rule: {
+            port_max: null,
+            port_min: null,
+            source_port_max: null,
+            source_port_min: null,
+            type: null,
+            code: null,
+          },
+          ruleProtocol: "all",
+          tcp: {
+            port_min: null,
+            port_max: null,
+            source_port_max: null,
+            source_port_min: null,
+          },
+          udp: {
+            port_min: null,
+            source_port_max: null,
+            source_port_min: null,
+            port_max: null,
+          },
+          icmp: {
+            type: null,
+            code: null,
+          },
+        },
+        "it should return data"
+      );
+    });
+    it("should render value for each type when present on sub rule but not main", () => {
+      assert.deepEqual(
+        craig.vpcs.acls.rules.type.onRender({
+          icmp: {
+            type: "443",
+          },
+        }),
+        "443",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.type.onRender({
+          icmp: {
+            type: "null",
+          },
+        }),
+        "",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.type.onRender({
+          icmp: {
+            type: "null",
+          },
+          type: "1234",
+        }),
+        "1234",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.code.onRender({
+          icmp: {
+            code: "null",
+          },
+        }),
+        "",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.type.onRender({
+          icmp: {
+            type: null,
+          },
+          type: "443",
+        }),
+        "443",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.code.onRender({
+          icmp: {
+            code: "443",
+          },
+        }),
+        "443",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.code.onRender({
+          icmp: {},
+          code: "443",
+        }),
+        "443",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.port_max.onRender({
+          tcp: {
+            port_max: "443",
+          },
+        }),
+        "443",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.port_min.onRender({
+          tcp: {
+            port_min: "443",
+          },
+        }),
+        "443",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.source_port_max.onRender({
+          tcp: {
+            source_port_max: "443",
+          },
+        }),
+        "443",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.source_port_min.onRender({
+          tcp: {
+            source_port_min: "443",
+          },
+        }),
+        "443",
+        "it should set sub rule"
+      );
+      assert.deepEqual(
+        craig.vpcs.acls.rules.source_port_min.onRender({
+          tcp: {
+            source_port_min: null,
+          },
+          source_port_min: "443",
+        }),
+        "443",
+        "it should set sub rule"
+      );
+    });
+    it("should set rule data on input change", () => {
+      let data = {
+        ruleProtocol: "all",
+      };
+      craig.vpcs.acls.rules.ruleProtocol.onInputChange(data);
+      assert.deepEqual(
+        data,
+        {
+          rule: {
+            port_max: null,
+            port_min: null,
+            source_port_max: null,
+            source_port_min: null,
+            type: null,
+            code: null,
+          },
+          ruleProtocol: "all",
+          tcp: {
+            port_max: null,
+            port_min: null,
+            source_port_max: null,
+            source_port_min: null,
+          },
+          udp: {
+            port_max: null,
+            port_min: null,
+            source_port_max: null,
+            source_port_min: null,
+          },
+          icmp: {
+            type: null,
+            code: null,
+          },
+        },
+        "it should set rule"
+      );
+    });
+    it("should render all as rule protocol", () => {
+      assert.deepEqual(
+        "ALL",
+        craig.vpcs.acls.rules.ruleProtocol.onRender({ ruleProtocol: "all" }),
+        "it should return protocol"
+      );
+    });
+    it("should render TCP as rule protocol", () => {
+      assert.deepEqual(
+        "TCP",
+        craig.vpcs.acls.rules.ruleProtocol.onRender({ ruleProtocol: "tcp" }),
+        "it should return protocol"
+      );
+    });
+    it("should render empty string as rule protocol", () => {
+      assert.deepEqual(
+        "",
+        craig.vpcs.acls.rules.ruleProtocol.onRender({ ruleProtocol: "" }),
+        "it should return protocol"
+      );
+    });
+    it("should return invalid for object when no source", () => {
+      assert.isTrue(
+        craig.vpcs.acls.rules.source.invalid({}),
+        "it should be true"
+      );
+    });
+    it("should return invalid for object when no destination", () => {
+      assert.isTrue(
+        craig.vpcs.acls.rules.destination.invalid({}),
+        "it should be true"
+      );
+    });
+  });
+});
diff --git a/unit-tests/state/vpn-servers.test.js b/unit-tests/state/vpn-servers.test.js
index 7a999232..2714333c 100644
--- a/unit-tests/state/vpn-servers.test.js
+++ b/unit-tests/state/vpn-servers.test.js
@@ -12,16 +12,18 @@ function newState() {
 }
 
 describe("vpn_servers", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("vpn_servers.init", () => {
     it("should initialize vpn_servers", () => {
-      let state = new newState();
-      assert.deepEqual(state.store.json.vpn_servers, []);
+      assert.deepEqual(craig.store.json.vpn_servers, []);
     });
   });
   describe("vpn_servers on store update", () => {
     it("should set fields to null or [] if vpc is invalid", () => {
-      let state = new newState();
-      state.vpn_servers.create({
+      craig.vpn_servers.create({
         name: "vpn-server",
         certificate_crn: "xyz",
         method: "certificate",
@@ -56,11 +58,10 @@ describe("vpn_servers", () => {
         routes: [],
         additional_prefixes: [],
       };
-      assert.deepEqual(state.store.json.vpn_servers[0], expectedData);
+      assert.deepEqual(craig.store.json.vpn_servers[0], expectedData);
     });
     it("should delete unfound items", () => {
-      let state = new newState();
-      state.vpn_servers.create({
+      craig.vpn_servers.create({
         name: "vpn-server",
         certificate_crn: "xyz",
         method: "certificate",
@@ -77,34 +78,21 @@ describe("vpn_servers", () => {
         vpc: "management",
         routes: [],
       });
-      let expectedData = {
-        name: "vpn-server",
-        certificate_crn: "xyz",
-        method: "certificate",
-        client_ca_crn: "xyz",
-        client_ip_pool: "xyz",
-        client_dns_server_ips: "optional",
-        client_idle_timeout: 2000,
-        enable_split_tunneling: true,
-        port: 255,
-        protocol: "udp",
-        resource_group: "management-rg",
-        security_groups: ["management-vpe"],
-        subnets: ["vsi-zone-1"],
-        vpc: "management",
-        routes: [],
-        additional_prefixes: [],
-      };
-      assert.deepEqual(state.store.json.vpn_servers[0], expectedData);
+      assert.deepEqual(
+        craig.store.json.vpn_servers[0].subnets,
+        ["vsi-zone-1"],
+        "it should delete unfound subnet"
+      );
+      assert.deepEqual(
+        craig.store.json.vpn_servers[0].additional_prefixes,
+        [],
+        "it should set additional prefixes"
+      );
     });
   });
   describe("vpn_servers crud operations", () => {
-    let state;
-    beforeEach(() => {
-      state = new newState();
-    });
     it("should create a vpn server", () => {
-      state.vpn_servers.create({
+      craig.vpn_servers.create({
         name: "vpn-server",
         certificate_crn: "xyz",
         method: "certificate",
@@ -121,7 +109,8 @@ describe("vpn_servers", () => {
         vpc: "management",
         routes: [],
       });
-      let expectedData = [
+      assert.deepEqual(
+        craig.store.json.vpn_servers[0],
         {
           name: "vpn-server",
           certificate_crn: "xyz",
@@ -140,12 +129,12 @@ describe("vpn_servers", () => {
           routes: [],
           additional_prefixes: [],
         },
-      ];
-      assert.deepEqual(state.store.json.vpn_servers, expectedData);
+        "it should create server"
+      );
     });
     it("should save a vpn server", () => {
-      state.store.json._options.dynamic_subnets = false;
-      state.vpn_servers.create({
+      craig.store.json._options.dynamic_subnets = false;
+      craig.vpn_servers.create({
         name: "vpn-server",
         certificate_crn: "xyz",
         method: "certificate",
@@ -162,7 +151,7 @@ describe("vpn_servers", () => {
         vpc: "management",
         routes: [],
       });
-      state.vpn_servers.save(
+      craig.vpn_servers.save(
         {
           name: "new-vpn-server",
           certificate_crn: "xyz",
@@ -204,10 +193,10 @@ describe("vpn_servers", () => {
         routes: [],
         additional_prefixes: [],
       };
-      assert.deepEqual(state.store.json.vpn_servers[0], expectedData);
+      assert.deepEqual(craig.store.json.vpn_servers[0], expectedData);
     });
     it("should delete vpn server", () => {
-      state.vpn_servers.create({
+      craig.vpn_servers.create({
         name: "vpn-server",
         certificate_crn: "xyz",
         method: "certificate",
@@ -224,7 +213,7 @@ describe("vpn_servers", () => {
         vpc: "management",
         routes: [],
       });
-      state.vpn_servers.delete(
+      craig.vpn_servers.delete(
         {},
         {
           data: {
@@ -232,13 +221,11 @@ describe("vpn_servers", () => {
           },
         }
       );
-      assert.deepEqual(state.store.json.vpn_servers, []);
+      assert.deepEqual(craig.store.json.vpn_servers, []);
     });
     describe("vpn server routes crud", () => {
-      let state;
       beforeEach(() => {
-        state = new newState();
-        state.vpn_servers.create({
+        craig.vpn_servers.create({
           name: "vpn-server",
           certificate_crn: "xyz",
           method: "certificate",
@@ -257,61 +244,57 @@ describe("vpn_servers", () => {
         });
       });
       it("should create a route", () => {
-        state.vpn_servers.routes.create(
+        craig.vpn_servers.routes.create(
           { name: "route", action: "deliver", destination: "2.2.2.2" },
           {
             innerFormProps: { arrayParentName: "vpn-server" },
-            arrayData: state.store.json.vpn_servers[0].routes,
+            arrayData: craig.store.json.vpn_servers[0].routes,
           }
         );
-        assert.deepEqual(state.store.json.vpn_servers[0].routes[0], {
+        assert.deepEqual(craig.store.json.vpn_servers[0].routes[0], {
           name: "route",
           action: "deliver",
           destination: "2.2.2.2",
         });
       });
       it("should update a route", () => {
-        state.vpn_servers.routes.create(
+        craig.vpn_servers.routes.create(
           { name: "route", action: "deliver", destination: "2.2.2.2" },
           {
             innerFormProps: { arrayParentName: "vpn-server" },
-            arrayData: state.store.json.vpn_servers[0].routes,
+            arrayData: craig.store.json.vpn_servers[0].routes,
           }
         );
-        state.vpn_servers.routes.save(
+        craig.vpn_servers.routes.save(
           { name: "route-new", action: "drop", destination: "" },
           {
             arrayParentName: "vpn-server",
             data: { name: "route" },
           }
         );
-        assert.deepEqual(state.store.json.vpn_servers[0].routes[0], {
+        assert.deepEqual(craig.store.json.vpn_servers[0].routes[0], {
           name: "route-new",
           action: "drop",
           destination: "",
         });
       });
       it("should delete a route", () => {
-        state.vpn_servers.routes.create(
+        craig.vpn_servers.routes.create(
           { name: "route", action: "deliver", destination: "2.2.2.2" },
           {
             innerFormProps: { arrayParentName: "vpn-server" },
-            arrayData: state.store.json.vpn_servers[0].routes,
+            arrayData: craig.store.json.vpn_servers[0].routes,
           }
         );
-        state.vpn_servers.routes.delete(
+        craig.vpn_servers.routes.delete(
           {},
           { arrayParentName: "vpn-server", data: { name: "route" } }
         );
-        assert.deepEqual(state.store.json.vpn_servers[0].routes, []);
+        assert.deepEqual(craig.store.json.vpn_servers[0].routes, []);
       });
     });
   });
   describe("vpn_servers schema", () => {
-    let craig;
-    beforeEach(() => {
-      craig = newState();
-    });
     it("should return empty string when not invalid", () => {
       assert.deepEqual(
         craig.vpn_servers.certificate_crn.invalidText({
diff --git a/unit-tests/state/vpn.test.js b/unit-tests/state/vpn.test.js
index 00f4d0c8..773fab24 100644
--- a/unit-tests/state/vpn.test.js
+++ b/unit-tests/state/vpn.test.js
@@ -13,11 +13,14 @@ function newState() {
 }
 
 describe("vpn_gateways", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("vpn_gateways.init", () => {
     it("should initialize vpn for default patterns", () => {
-      let state = new newState();
       assert.deepEqual(
-        state.store.json.vpn_gateways,
+        craig.store.json.vpn_gateways,
         [
           {
             name: "management-gateway",
@@ -32,7 +35,6 @@ describe("vpn_gateways", () => {
   });
   describe("vpn_gatways.onStoreUpdate", () => {
     it("should remove subnet name and vpc name on deletion", () => {
-      let state = new newState();
       let expectedData = [
         {
           name: "management-gateway",
@@ -42,25 +44,15 @@ describe("vpn_gateways", () => {
           connections: [],
         },
       ];
-      state.vpcs.delete({}, { data: { name: "management" } });
+      craig.vpcs.delete({}, { data: { name: "management" } });
       assert.deepEqual(
-        state.store.json.vpn_gateways,
+        craig.store.json.vpn_gateways,
         expectedData,
         "it should update gateways"
       );
     });
     it("should remove unfound subnet name if vpc exists", () => {
-      let state = new newState();
-      let expectedData = [
-        {
-          name: "management-gateway",
-          resource_group: "management-rg",
-          subnet: null,
-          vpc: "management",
-          connections: [],
-        },
-      ];
-      state.vpcs.subnets.delete(
+      craig.vpcs.subnets.delete(
         {},
         {
           name: "management",
@@ -70,36 +62,25 @@ describe("vpn_gateways", () => {
         }
       );
       assert.deepEqual(
-        state.store.json.vpn_gateways,
-        expectedData,
+        craig.store.json.vpn_gateways[0].subnet,
+        null,
         "it should update gateways"
       );
     });
     it("should remove unfound resource groups", () => {
-      let state = new newState();
-      let expectedData = [
-        {
-          name: "management-gateway",
-          resource_group: null,
-          subnet: "vpn-zone-1",
-          vpc: "management",
-          connections: [],
-        },
-      ];
-      state.resource_groups.delete({}, { data: { name: "management-rg" } });
+      craig.resource_groups.delete({}, { data: { name: "management-rg" } });
       assert.deepEqual(
-        state.store.json.vpn_gateways,
-        expectedData,
+        craig.store.json.vpn_gateways[0].resource_group,
+        null,
         "it should update gateways"
       );
     });
   });
   describe("vpn_gateways.delete", () => {
     it("should delete a vpn gateway by name", () => {
-      let state = new newState();
-      state.vpn_gateways.delete({}, { data: { name: "management-gateway" } });
+      craig.vpn_gateways.delete({}, { data: { name: "management-gateway" } });
       assert.deepEqual(
-        state.store.json.vpn_gateways,
+        craig.store.json.vpn_gateways,
         [],
         "it should delete the gw"
       );
@@ -107,17 +88,7 @@ describe("vpn_gateways", () => {
   });
   describe("vpn_gateways.save", () => {
     it("should update a vpn gateway", () => {
-      let state = new newState();
-      let expectedData = [
-        {
-          name: "todd",
-          resource_group: "management-rg",
-          subnet: "vpe-zone-1",
-          vpc: "workload",
-          connections: [],
-        },
-      ];
-      state.vpn_gateways.save(
+      craig.vpn_gateways.save(
         {
           name: "todd",
           vpc: "workload",
@@ -130,23 +101,13 @@ describe("vpn_gateways", () => {
         }
       );
       assert.deepEqual(
-        state.store.json.vpn_gateways,
-        expectedData,
+        craig.store.json.vpn_gateways[0].vpc,
+        "workload",
         "it should change the gw"
       );
     });
     it("should update a vpn gateway with same name different everything else", () => {
-      let state = new newState();
-      let expectedData = [
-        {
-          name: "management-gateway",
-          resource_group: "workload-rg",
-          subnet: "vpe-zone-1",
-          vpc: "workload",
-          connections: [],
-        },
-      ];
-      state.vpn_gateways.save(
+      craig.vpn_gateways.save(
         {
           name: "management-gateway",
           vpc: "workload",
@@ -160,22 +121,29 @@ describe("vpn_gateways", () => {
         }
       );
       assert.deepEqual(
-        state.store.json.vpn_gateways,
-        expectedData,
+        craig.store.json.vpn_gateways,
+        [
+          {
+            name: "management-gateway",
+            resource_group: "workload-rg",
+            subnet: "vpe-zone-1",
+            vpc: "workload",
+            connections: [],
+          },
+        ],
         "it should change the gw"
       );
     });
   });
   describe("vpn_gateways.create", () => {
     it("should add a new vpn gateway", () => {
-      let expectedData = [
-        {
-          name: "management-gateway",
-          resource_group: "management-rg",
-          subnet: "vpn-zone-1",
-          vpc: "management",
-          connections: [],
-        },
+      craig.vpn_gateways.create({
+        name: "todd",
+        subnet: "vpn-zone-1",
+        vpc: "management",
+      });
+      assert.deepEqual(
+        craig.store.json.vpn_gateways[1],
         {
           name: "todd",
           resource_group: null,
@@ -183,25 +151,11 @@ describe("vpn_gateways", () => {
           vpc: "management",
           connections: [],
         },
-      ];
-      let state = new newState();
-      state.vpn_gateways.create({
-        name: "todd",
-        subnet: "vpn-zone-1",
-        vpc: "management",
-      });
-      assert.deepEqual(
-        state.store.json.vpn_gateways,
-        expectedData,
         "it should add the gw"
       );
     });
   });
   describe("schema", () => {
-    let craig;
-    beforeEach(() => {
-      craig = newState();
-    });
     it("should reset subnet on state change", () => {
       let expectedData = {
         subnet: "",
diff --git a/unit-tests/state/vsi.test.js b/unit-tests/state/vsi.test.js
index 3d0ae3c6..276d143c 100644
--- a/unit-tests/state/vsi.test.js
+++ b/unit-tests/state/vsi.test.js
@@ -12,10 +12,13 @@ function newState() {
 }
 
 describe("vsi", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("vsi.create", () => {
     it("should return the correct vsi deployment", () => {
-      let state = new newState();
-      state.vsi.create(
+      craig.vsi.create(
         {
           name: "test-vsi",
           vpc: "management",
@@ -26,7 +29,7 @@ describe("vsi", () => {
         }
       );
       assert.deepEqual(
-        state.store.json.vsi[1],
+        craig.store.json.vsi[1],
         {
           kms: null,
           encryption_key: null,
@@ -48,14 +51,13 @@ describe("vsi", () => {
         "it should return correct server"
       );
       assert.deepEqual(
-        state.store.vsiList,
+        craig.store.vsiList,
         ["management-server", "test-vsi"],
         "it should set vsiList"
       );
     });
     it("should find kms based on key", () => {
-      let state = new newState();
-      state.vsi.create(
+      craig.vsi.create(
         {
           name: "test-vsi",
           vpc: "management",
@@ -66,7 +68,7 @@ describe("vsi", () => {
         }
       );
       assert.deepEqual(
-        state.store.json.vsi[1],
+        craig.store.json.vsi[1],
         {
           kms: "kms",
           encryption_key: "atracker-key",
@@ -88,7 +90,7 @@ describe("vsi", () => {
         "it should return correct server"
       );
       assert.deepEqual(
-        state.store.vsiList,
+        craig.store.vsiList,
         ["management-server", "test-vsi"],
         "it should set vsiList"
       );
@@ -96,54 +98,34 @@ describe("vsi", () => {
   });
   describe("vsi.save", () => {
     it("should update in place with new name", () => {
-      let state = new newState();
-      state.vsi.create(
+      craig.vsi.create(
         { name: "todd", vpc: "management" },
         { isTeleport: false }
       );
-      let expectedData = {
-        kms: null,
-        encryption_key: null,
-        image: null,
-        image_name: null,
-        profile: null,
-        name: "test-vsi",
-        security_groups: [],
-        ssh_keys: [],
-        subnets: [],
-        vpc: "management",
-        vsi_per_subnet: null,
-        resource_group: null,
-        override_vsi_name: null,
-        user_data: null,
-        network_interfaces: [],
-        volumes: [],
-      };
-      state.store.json.load_balancers.push({
+      craig.store.json.load_balancers.push({
         name: "lb",
         target_vsi: ["todd"],
         subnets: [],
         security_groups: [],
       });
-      state.store.json.load_balancers.push({
+      craig.store.json.load_balancers.push({
         name: "lb2",
         target_vsi: ["frog"],
         subnets: [],
         security_groups: [],
       });
-      state.vsi.save(
+      craig.vsi.save(
         { name: "test-vsi" },
         { data: { name: "todd" }, isTeleport: false }
       );
       assert.deepEqual(
-        state.store.json.vsi[1],
-        expectedData,
+        craig.store.json.vsi[1].name,
+        "test-vsi",
         "it should update in place"
       );
     });
     it("should update in place with same name", () => {
-      let state = new newState();
-      state.vsi.create(
+      craig.vsi.create(
         {
           name: "todd",
           vpc: "management",
@@ -151,37 +133,23 @@ describe("vsi", () => {
         },
         { isTeleport: false }
       );
-      let expectedData = {
-        kms: null,
-        encryption_key: null,
-        image: null,
-        image_name: null,
-        profile: null,
-        name: "todd",
-        security_groups: [],
-        ssh_keys: [],
-        subnets: [],
-        vpc: "workload",
-        vsi_per_subnet: null,
-        resource_group: null,
-        override_vsi_name: null,
-        user_data: null,
-        network_interfaces: [],
-        volumes: [],
-      };
-      state.vsi.save(
+      craig.vsi.save(
         { name: "todd", vpc: "workload", security_groups: ["workload-vsi"] },
         { data: { name: "todd" }, isTeleport: false }
       );
       assert.deepEqual(
-        state.store.json.vsi[1],
-        expectedData,
+        craig.store.json.vsi[1].security_groups,
+        [],
         "it should update in place"
       );
+      assert.deepEqual(
+        craig.store.json.vsi[1].vpc,
+        "workload",
+        "it should have correct data"
+      );
     });
     it("should update in place with same name when kms is null", () => {
-      let state = new newState();
-      state.vsi.create(
+      craig.vsi.create(
         {
           name: "todd",
           vpc: "management",
@@ -189,25 +157,7 @@ describe("vsi", () => {
         },
         { isTeleport: false }
       );
-      let expectedData = {
-        kms: "kms",
-        encryption_key: "key",
-        image: null,
-        image_name: null,
-        profile: null,
-        name: "todd",
-        security_groups: [],
-        ssh_keys: [],
-        subnets: [],
-        vpc: "workload",
-        vsi_per_subnet: null,
-        resource_group: null,
-        override_vsi_name: null,
-        user_data: null,
-        network_interfaces: [],
-        volumes: [],
-      };
-      state.vsi.save(
+      craig.vsi.save(
         {
           name: "todd",
           vpc: "workload",
@@ -217,48 +167,25 @@ describe("vsi", () => {
         { data: { name: "todd" }, isTeleport: false }
       );
       assert.deepEqual(
-        state.store.json.vsi[1],
-        expectedData,
+        craig.store.json.vsi[1].kms,
+        "kms",
+        "it should update in place"
+      );
+      assert.deepEqual(
+        craig.store.json.vsi[1].encryption_key,
+        "key",
         "it should update in place"
       );
     });
     it("should update in place with network interfaces", () => {
-      let state = new newState();
-      state.vsi.create(
+      craig.vsi.create(
         {
           name: "todd",
           vpc: "management",
         },
         { isTeleport: false }
       );
-      let expectedData = {
-        kms: null,
-        encryption_key: null,
-        image: null,
-        image_name: null,
-        profile: null,
-        name: "todd",
-        security_groups: [],
-        ssh_keys: [],
-        subnets: [],
-        vpc: "management",
-        vsi_per_subnet: null,
-        resource_group: null,
-        override_vsi_name: null,
-        user_data: null,
-        network_interfaces: [
-          {
-            subnet: "f5-bastion-zone-1",
-            security_groups: ["f5-bastion-sg"],
-          },
-          {
-            subnet: "f5-external-zone-1",
-            security_groups: ["f5-external-sg"],
-          },
-        ],
-        volumes: [],
-      };
-      state.vsi.save(
+      craig.vsi.save(
         {
           name: "todd",
           vpc: "management",
@@ -277,39 +204,29 @@ describe("vsi", () => {
         { data: { name: "todd" }, isTeleport: false }
       );
       assert.deepEqual(
-        state.store.json.vsi[1],
-        expectedData,
+        craig.store.json.vsi[1].network_interfaces,
+        [
+          {
+            subnet: "f5-bastion-zone-1",
+            security_groups: ["f5-bastion-sg"],
+          },
+          {
+            subnet: "f5-external-zone-1",
+            security_groups: ["f5-external-sg"],
+          },
+        ],
         "it should update in place"
       );
     });
     it("should update in place with image given image_name", () => {
-      let state = new newState();
-      state.vsi.create(
+      craig.vsi.create(
         {
           name: "todd",
           vpc: "management",
         },
         { isTeleport: false }
       );
-      let expectedData = {
-        kms: null,
-        encryption_key: null,
-        image: "id",
-        image_name: "Description name [id]",
-        profile: null,
-        name: "todd",
-        security_groups: [],
-        ssh_keys: [],
-        subnets: [],
-        vpc: "management",
-        vsi_per_subnet: null,
-        resource_group: null,
-        override_vsi_name: null,
-        user_data: null,
-        network_interfaces: [],
-        volumes: [],
-      };
-      state.vsi.save(
+      craig.vsi.save(
         {
           name: "todd",
           vpc: "management",
@@ -318,23 +235,21 @@ describe("vsi", () => {
         { data: { name: "todd" }, isTeleport: false }
       );
       assert.deepEqual(
-        state.store.json.vsi[1],
-        expectedData,
+        craig.store.json.vsi[1].image_name,
+        "Description name [id]",
         "it should update in place"
       );
     });
   });
   describe("vsi.delete", () => {
     it("should delete a vsi deployment", () => {
-      let state = new newState();
-      state.vsi.delete({}, { data: { name: "management-server" } });
-      assert.deepEqual(state.store.json.vsi, [], "it should have none servers");
+      craig.vsi.delete({}, { data: { name: "management-server" } });
+      assert.deepEqual(craig.store.json.vsi, [], "it should have none servers");
     });
   });
   describe("vsi.onStoreUpdate", () => {
     it("should set encryption key to null when deleted", () => {
-      let state = new newState();
-      state.key_management.keys.delete(
+      craig.key_management.keys.delete(
         {},
         {
           arrayParentName: "kms",
@@ -343,14 +258,13 @@ describe("vsi", () => {
         }
       );
       assert.deepEqual(
-        state.store.json.vsi[0].encryption_key,
+        craig.store.json.vsi[0].encryption_key,
         null,
         "it should be null"
       );
     });
     it("should set ssh keys to empty array when deleted", () => {
-      let state = new newState();
-      state.ssh_keys.delete(
+      craig.ssh_keys.delete(
         {},
         {
           data: {
@@ -358,33 +272,27 @@ describe("vsi", () => {
           },
         }
       );
-      assert.deepEqual(state.store.json.vsi[0].ssh_keys, [], "it should be []");
+      assert.deepEqual(craig.store.json.vsi[0].ssh_keys, [], "it should be []");
     });
     it("should set subnets and security groups when vpc deleted", () => {
-      let state = new newState();
-      state.vpcs.delete({}, { data: { name: "management" } });
-      assert.deepEqual(state.store.json.vsi[0].subnets, [], "it should be []");
+      craig.vpcs.delete({}, { data: { name: "management" } });
+      assert.deepEqual(craig.store.json.vsi[0].subnets, [], "it should be []");
       assert.deepEqual(
-        state.store.json.vsi[0].security_groups,
+        craig.store.json.vsi[0].security_groups,
         [],
         "it should be []"
       );
     });
     it("should set security groups when deleted", () => {
-      let state = new newState();
-      state.security_groups.delete({}, { data: { name: "management-vsi" } });
+      craig.security_groups.delete({}, { data: { name: "management-vsi" } });
       assert.deepEqual(
-        state.store.json.vsi[0].security_groups,
+        craig.store.json.vsi[0].security_groups,
         [],
         "it should be []"
       );
     });
   });
   describe("vsi.schema", () => {
-    let craig;
-    beforeEach(() => {
-      craig = newState();
-    });
     it("should reset security groups and subnets on state change", () => {
       let expectedData = {
         security_groups: [],
@@ -467,10 +375,12 @@ describe("vsi", () => {
     });
   });
   describe("volumes", () => {
+    beforeEach(() => {
+      craig = newState();
+    });
     describe("volumes.create", () => {
       it("should create a new vsi volume", () => {
-        let state = new newState();
-        state.vsi.volumes.create(
+        craig.vsi.volumes.create(
           {
             name: "block-storage-1",
             profile: "custom",
@@ -485,7 +395,7 @@ describe("vsi", () => {
           }
         );
         assert.deepEqual(
-          state.store.json.vsi[0].volumes,
+          craig.store.json.vsi[0].volumes,
           [
             {
               name: "block-storage-1",
@@ -501,8 +411,7 @@ describe("vsi", () => {
     });
     describe("volumes.save", () => {
       it("should save a vsi volume", () => {
-        let state = new newState();
-        state.vsi.volumes.create(
+        craig.vsi.volumes.create(
           {
             name: "block-storage-1",
             profile: "custom",
@@ -520,7 +429,7 @@ describe("vsi", () => {
             },
           }
         );
-        state.vsi.volumes.save(
+        craig.vsi.volumes.save(
           {
             name: "frog",
             profile: "custom",
@@ -536,41 +445,32 @@ describe("vsi", () => {
           }
         );
         assert.deepEqual(
-          state.store.json.vsi[0].volumes,
-          [
-            {
-              name: "frog",
-              profile: "custom",
-              capacity: 200,
-              iops: 1000,
-              encryption_key: "slz-vsi-volume-key",
-            },
-          ],
+          craig.store.json.vsi[0].volumes[0].name,
+          "frog",
           "it should be null"
         );
       });
     });
     describe("volumes.delete", () => {
-      let state = new newState();
-      state.vsi.volumes.create(
-        {
-          name: "block-storage-1",
-          profile: "custom",
-          capacity: 200,
-          iops: 1000,
-          encryption_key: "slz-vsi-volume-key",
-        },
-        {
-          data: {
+      it("should delete a vsi volume", () => {
+        craig.vsi.volumes.create(
+          {
             name: "block-storage-1",
+            profile: "custom",
+            capacity: 200,
+            iops: 1000,
+            encryption_key: "slz-vsi-volume-key",
           },
-          innerFormProps: {
-            arrayParentName: "management-server",
-          },
-        }
-      );
-      it("should delete a vsi volume", () => {
-        state.vsi.volumes.delete(
+          {
+            data: {
+              name: "block-storage-1",
+            },
+            innerFormProps: {
+              arrayParentName: "management-server",
+            },
+          }
+        );
+        craig.vsi.volumes.delete(
           {},
           {
             data: {
@@ -581,7 +481,7 @@ describe("vsi", () => {
           }
         );
         assert.deepEqual(
-          state.store.json.vsi[0].volumes,
+          craig.store.json.vsi[0].volumes,
           [],
           "it should be null"
         );
diff --git a/unit-tests/state/vtl.test.js b/unit-tests/state/vtl.test.js
index 4766f4bb..3a14940d 100644
--- a/unit-tests/state/vtl.test.js
+++ b/unit-tests/state/vtl.test.js
@@ -1,5 +1,6 @@
 const { assert } = require("chai");
 const { state } = require("../../client/src/lib/state");
+const { distinct, flatten, splat } = require("lazy-z");
 /**
  * initialize store
  * @returns {lazyZState} state store
@@ -11,21 +12,23 @@ function newState() {
 }
 
 describe("vtl", () => {
+  let craig;
+  beforeEach(() => {
+    craig = newState();
+  });
   describe("vtl.init", () => {
     it("should initialize power vs instances", () => {
-      let state = newState();
-      assert.deepEqual(state.store.json.vtl, [], "it should initialize data");
+      assert.deepEqual(craig.store.json.vtl, [], "it should initialize data");
     });
   });
   describe("vtl.create", () => {
     it("should create a new power vs instance", () => {
-      let state = newState();
-      state.vtl.create({
+      craig.vtl.create({
         name: "frog",
         zone: "dal12",
       });
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "frog",
@@ -41,14 +44,13 @@ describe("vtl", () => {
       );
     });
     it("should create a new power vs instance with SAP and create volumes", () => {
-      let state = newState();
-      state.vtl.create({
+      craig.vtl.create({
         name: "frog",
         sap: true,
         sap_profile: "ush1-4x128",
       });
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "frog",
@@ -65,7 +67,7 @@ describe("vtl", () => {
         "it should create instance"
       );
       assert.deepEqual(
-        state.store.json.power_volumes,
+        craig.store.json.power_volumes,
         [
           {
             attachments: ["frog"],
@@ -182,8 +184,7 @@ describe("vtl", () => {
   });
   describe("vtl.save", () => {
     it("should save a power vs instance", () => {
-      let state = newState();
-      state.vtl.create({
+      craig.vtl.create({
         name: "toad",
         image: null,
         ssh_key: null,
@@ -191,7 +192,7 @@ describe("vtl", () => {
         workspace: null,
         zone: null,
       });
-      state.vtl.save(
+      craig.vtl.save(
         {
           name: "frog",
         },
@@ -202,7 +203,7 @@ describe("vtl", () => {
         }
       );
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "frog",
@@ -218,18 +219,17 @@ describe("vtl", () => {
       );
     });
     it("should update power vs volume names when updating sap instance name", () => {
-      let state = newState();
-      state.store.json.power_volumes.push({
+      craig.store.json.power_volumes.push({
         attachments: null,
         workspace: null,
         name: "ignore-me",
       });
-      state.vtl.create({
+      craig.vtl.create({
         name: "frog",
         sap: true,
         sap_profile: "ush1-4x128",
       });
-      state.vtl.save(
+      craig.vtl.save(
         {
           name: "toad",
           sap: true,
@@ -245,7 +245,7 @@ describe("vtl", () => {
       );
 
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "toad",
@@ -262,139 +262,24 @@ describe("vtl", () => {
         "it should create instance"
       );
       assert.deepEqual(
-        state.store.json.power_volumes,
-        [
-          {
-            attachments: [],
-            name: "ignore-me",
-            workspace: null,
-          },
-          {
-            attachments: ["toad"],
-            workspace: undefined,
-            name: "toad-sap-data-1",
-            pi_volume_type: "tier1",
-            mount: "/hana/data",
-            pi_volume_size: 71,
-            sap: true,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: undefined,
-          },
-          {
-            attachments: ["toad"],
-            workspace: undefined,
-            name: "toad-sap-data-2",
-            pi_volume_type: "tier1",
-            mount: "/hana/data",
-            pi_volume_size: 71,
-            sap: true,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: undefined,
-          },
-          {
-            attachments: ["toad"],
-            workspace: undefined,
-            name: "toad-sap-data-3",
-            pi_volume_type: "tier1",
-            mount: "/hana/data",
-            pi_volume_size: 71,
-            sap: true,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: undefined,
-          },
-          {
-            attachments: ["toad"],
-            workspace: undefined,
-            name: "toad-sap-data-4",
-            pi_volume_type: "tier1",
-            mount: "/hana/data",
-            pi_volume_size: 71,
-            sap: true,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: undefined,
-          },
-          {
-            attachments: ["toad"],
-            workspace: undefined,
-            name: "toad-sap-log-1",
-            pi_volume_type: "tier1",
-            mount: "/hana/log",
-            pi_volume_size: 33,
-            sap: true,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: undefined,
-          },
-          {
-            attachments: ["toad"],
-            workspace: undefined,
-            name: "toad-sap-log-2",
-            pi_volume_type: "tier1",
-            mount: "/hana/log",
-            pi_volume_size: 33,
-            sap: true,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: undefined,
-          },
-          {
-            attachments: ["toad"],
-            workspace: undefined,
-            name: "toad-sap-log-3",
-            pi_volume_type: "tier1",
-            mount: "/hana/log",
-            pi_volume_size: 33,
-            sap: true,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: undefined,
-          },
-          {
-            attachments: ["toad"],
-            workspace: undefined,
-            name: "toad-sap-log-4",
-            pi_volume_type: "tier1",
-            mount: "/hana/log",
-            pi_volume_size: 33,
-            sap: true,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: undefined,
-          },
-          {
-            attachments: ["toad"],
-            workspace: undefined,
-            name: "toad-sap-shared",
-            pi_volume_type: "tier3",
-            mount: "/hana/shared",
-            pi_volume_size: 256,
-            sap: true,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: undefined,
-          },
-        ],
+        distinct(flatten(splat(craig.store.json.power_volumes, "attachments"))),
+        ["toad"],
         "it should create correct volumes"
       );
     });
     it("should update power vs volume sizes when updating sap instance profile", () => {
-      let state = newState();
-      state.store.json.power_volumes.push({
+      craig.store.json.power_volumes.push({
         attachments: null,
         workspace: null,
         name: "ignore-me",
       });
-      state.vtl.create({
+      craig.vtl.create({
         name: "frog",
         sap: true,
         sap_profile: "ush1-4x128",
         zone: "dal12",
       });
-      state.vtl.save(
+      craig.vtl.save(
         {
           name: "toad",
           sap: true,
@@ -410,7 +295,7 @@ describe("vtl", () => {
       );
 
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "toad",
@@ -427,146 +312,24 @@ describe("vtl", () => {
         "it should create instance"
       );
       assert.deepEqual(
-        state.store.json.power_volumes,
-        [
-          {
-            attachments: [],
-            name: "ignore-me",
-            workspace: null,
-          },
-          {
-            attachments: ["toad"],
-            workspace: null,
-            name: "toad-sap-data-1",
-            pi_volume_type: "tier1",
-            mount: "/hana/data",
-            pi_volume_size: 3851,
-            sap: true,
-            workspace: undefined,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: "dal12",
-          },
-          {
-            attachments: ["toad"],
-            workspace: null,
-            name: "toad-sap-data-2",
-            pi_volume_type: "tier1",
-            mount: "/hana/data",
-            pi_volume_size: 3851,
-            sap: true,
-            workspace: undefined,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: "dal12",
-          },
-          {
-            attachments: ["toad"],
-            workspace: null,
-            name: "toad-sap-data-3",
-            pi_volume_type: "tier1",
-            mount: "/hana/data",
-            pi_volume_size: 3851,
-            sap: true,
-            workspace: undefined,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: "dal12",
-          },
-          {
-            attachments: ["toad"],
-            workspace: null,
-            name: "toad-sap-data-4",
-            pi_volume_type: "tier1",
-            mount: "/hana/data",
-            pi_volume_size: 3851,
-            sap: true,
-            workspace: undefined,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: "dal12",
-          },
-          {
-            attachments: ["toad"],
-            workspace: null,
-            name: "toad-sap-log-1",
-            pi_volume_type: "tier1",
-            mount: "/hana/log",
-            pi_volume_size: 512,
-            sap: true,
-            workspace: undefined,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: "dal12",
-          },
-          {
-            attachments: ["toad"],
-            workspace: null,
-            name: "toad-sap-log-2",
-            pi_volume_type: "tier1",
-            mount: "/hana/log",
-            pi_volume_size: 512,
-            sap: true,
-            workspace: undefined,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: "dal12",
-          },
-          {
-            attachments: ["toad"],
-            workspace: null,
-            name: "toad-sap-log-3",
-            pi_volume_type: "tier1",
-            mount: "/hana/log",
-            pi_volume_size: 512,
-            sap: true,
-            workspace: undefined,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: "dal12",
-          },
-          {
-            attachments: ["toad"],
-            workspace: null,
-            name: "toad-sap-log-4",
-            pi_volume_type: "tier1",
-            mount: "/hana/log",
-            pi_volume_size: 512,
-            sap: true,
-            workspace: undefined,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: "dal12",
-          },
-          {
-            attachments: ["toad"],
-            workspace: null,
-            name: "toad-sap-shared",
-            pi_volume_type: "tier3",
-            mount: "/hana/shared",
-            pi_volume_size: 1024,
-            sap: true,
-            workspace: undefined,
-            storage_option: "Storage Type",
-            affinity_type: null,
-            zone: "dal12",
-          },
-        ],
+        distinct(
+          flatten(splat(craig.store.json.power_volumes, "pi_volume_size"))
+        ),
+        [undefined, 3851, 512, 1024],
         "it should create correct volumes"
       );
     });
     it("should create power vs volumes when converting non-sap instance to sap", () => {
-      let state = newState();
-      state.store.json.power_volumes.push({
+      craig.store.json.power_volumes.push({
         attachments: null,
         workspace: null,
         name: "ignore-me",
       });
-      state.vtl.create({
+      craig.vtl.create({
         name: "frog",
         zone: "dal12",
       });
-      state.vtl.save(
+      craig.vtl.save(
         {
           name: "toad",
           sap: true,
@@ -582,7 +345,7 @@ describe("vtl", () => {
       );
 
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "toad",
@@ -599,7 +362,7 @@ describe("vtl", () => {
         "it should create instance"
       );
       assert.deepEqual(
-        state.store.json.power_volumes,
+        craig.store.json.power_volumes,
         [
           {
             attachments: [],
@@ -719,24 +482,23 @@ describe("vtl", () => {
       );
     });
     it("should update power vs volume workspace when changing instance workspace", () => {
-      let state = newState();
-      state.store.json._options.power_vs_zones = ["dal12", "dal10"];
-      state.power.create({
+      craig.store.json._options.power_vs_zones = ["dal12", "dal10"];
+      craig.power.create({
         name: "toad",
         images: [{ name: "7100-05-09", workspace: "toad" }],
         zone: "dal12",
       });
-      state.power.create({
+      craig.power.create({
         name: "frog",
         images: [{ name: "7100-05-09", workspace: "frog" }],
         zone: "dal12",
       });
-      state.store.json.power_volumes.push({
+      craig.store.json.power_volumes.push({
         attachments: [],
         workspace: null,
         name: "ignore-me",
       });
-      state.vtl.create({
+      craig.vtl.create({
         name: "frog",
         sap: true,
         sap_profile: "ush1-4x128",
@@ -744,7 +506,7 @@ describe("vtl", () => {
         workspace: "frog",
         network: [],
       });
-      state.vtl.save(
+      craig.vtl.save(
         {
           name: "toad",
           sap: true,
@@ -765,7 +527,7 @@ describe("vtl", () => {
       );
 
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "toad",
@@ -781,7 +543,7 @@ describe("vtl", () => {
         "it should create instance"
       );
       assert.deepEqual(
-        state.store.json.power_volumes,
+        craig.store.json.power_volumes,
         [
           {
             attachments: [],
@@ -901,18 +663,17 @@ describe("vtl", () => {
       );
     });
     it("should delete power vs volumes when converting sap volume to non-sap", () => {
-      let state = newState();
-      state.store.json.power_volumes.push({
+      craig.store.json.power_volumes.push({
         attachments: null,
         workspace: null,
         name: "ignore-me",
       });
-      state.vtl.create({
+      craig.vtl.create({
         name: "frog",
         sap: true,
         sap_profile: "ush1-4x128",
       });
-      state.vtl.save(
+      craig.vtl.save(
         {
           name: "toad",
         },
@@ -925,7 +686,7 @@ describe("vtl", () => {
       );
 
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "toad",
@@ -942,7 +703,7 @@ describe("vtl", () => {
         "it should create instance"
       );
       assert.deepEqual(
-        state.store.json.power_volumes,
+        craig.store.json.power_volumes,
         [
           {
             attachments: [],
@@ -956,11 +717,10 @@ describe("vtl", () => {
   });
   describe("vtl.delete", () => {
     it("should delete a power vs instance", () => {
-      let state = newState();
-      state.vtl.create({
+      craig.vtl.create({
         name: "toad",
       });
-      state.vtl.delete(
+      craig.vtl.delete(
         {
           name: "frog",
         },
@@ -970,21 +730,20 @@ describe("vtl", () => {
           },
         }
       );
-      assert.deepEqual(state.store.json.vtl, [], "it should delete instance");
+      assert.deepEqual(craig.store.json.vtl, [], "it should delete instance");
     });
     it("should delete power vs volumes when deleting sap instance", () => {
-      let state = newState();
-      state.store.json.power_volumes.push({
+      craig.store.json.power_volumes.push({
         attachments: null,
         workspace: null,
         name: "ignore-me",
       });
-      state.vtl.create({
+      craig.vtl.create({
         name: "frog",
         sap: true,
         sap_profile: "ush1-4x128",
       });
-      state.vtl.delete(
+      craig.vtl.delete(
         {
           name: "toad",
           sap: true,
@@ -998,9 +757,9 @@ describe("vtl", () => {
         }
       );
 
-      assert.deepEqual(state.store.json.vtl, [], "it should create instance");
+      assert.deepEqual(craig.store.json.vtl, [], "it should create instance");
       assert.deepEqual(
-        state.store.json.power_volumes,
+        craig.store.json.power_volumes,
         [
           {
             attachments: [],
@@ -1014,14 +773,12 @@ describe("vtl", () => {
   });
   describe("vtl.onStoreUpdate", () => {
     it("should add power when not created on store update", () => {
-      let state = newState();
-      delete state.store.json.vtl;
-      state.update();
-      assert.deepEqual(state.store.json.vtl, [], "it should initialize data");
+      delete craig.store.json.vtl;
+      craig.update();
+      assert.deepEqual(craig.store.json.vtl, [], "it should initialize data");
     });
     it("should update ssh key, network, image, primary subnet, and workspace when unfound", () => {
-      let state = newState();
-      state.vtl.create({
+      craig.vtl.create({
         name: "toad",
         image: "oops",
         ssh_key: "oops",
@@ -1036,7 +793,7 @@ describe("vtl", () => {
         primary_subnet: "oops",
       });
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "toad",
@@ -1052,13 +809,12 @@ describe("vtl", () => {
       );
     });
     it("should update ssh key, network, image, and priamry subnet when workspace is unfound", () => {
-      let state = newState();
-      state.power.create({
+      craig.power.create({
         name: "toad",
         images: [{ name: "7100-05-09", workspace: "toad" }],
         zone: "dal10",
       });
-      state.vtl.create({
+      craig.vtl.create({
         name: "toad",
         image: "oops",
         ssh_key: "oops",
@@ -1073,7 +829,7 @@ describe("vtl", () => {
         primary_subnet: "oops",
       });
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "toad",
@@ -1089,13 +845,12 @@ describe("vtl", () => {
       );
     });
     it("should update primary_subnet when network interface is unfound", () => {
-      let state = newState();
-      state.power.create({
+      craig.power.create({
         name: "toad",
         imageNames: ["7100-05-09"],
         zone: "dal10",
       });
-      state.vtl.create({
+      craig.vtl.create({
         name: "toad",
         image: "oops",
         ssh_key: "oops",
@@ -1110,7 +865,7 @@ describe("vtl", () => {
         primary_subnet: "oops",
       });
       assert.deepEqual(
-        state.store.json.vtl,
+        craig.store.json.vtl,
         [
           {
             name: "toad",
@@ -1127,18 +882,17 @@ describe("vtl", () => {
       );
     });
     it("should not update image when still in existing workspace", () => {
-      let state = newState();
-      state.power.create({
+      craig.power.create({
         name: "toad",
         images: [{ name: "7100-05-09", workspace: "toad" }],
         imageNames: ["7100-05-09"],
         zone: "dal10",
       });
-      state.power.network.create(
+      craig.power.network.create(
         { name: "test-network" },
         { innerFormProps: { arrayParentName: "toad" } }
       );
-      state.vtl.create({
+      craig.vtl.create({
         name: "toad",
         image: "7100-05-09",
         ssh_key: "oops",
@@ -1156,43 +910,27 @@ describe("vtl", () => {
       });
 
       assert.deepEqual(
-        state.store.json.vtl,
-        [
-          {
-            name: "toad",
-            image: "7100-05-09",
-            ssh_key: null,
-            network: [
-              {
-                name: "test-network",
-              },
-            ],
-            primary_subnet: null,
-            workspace: "toad",
-            zone: null,
-            pi_storage_type: null,
-          },
-        ],
+        craig.store.json.vtl[0].image,
+        "7100-05-09",
         "it should initialize data"
       );
     });
     it("should not update ssh key when still in existing workspace", () => {
-      let state = newState();
-      state.power.create({
+      craig.power.create({
         name: "toad",
         images: [{ name: "7100-05-09", workspace: "toad" }],
         zone: "dal10",
         imageNames: ["7100-05-09"],
       });
-      state.power.ssh_keys.create(
+      craig.power.ssh_keys.create(
         { name: "test-key" },
         { innerFormProps: { arrayParentName: "toad" } }
       );
-      state.power.network.create(
+      craig.power.network.create(
         { name: "test-network" },
         { innerFormProps: { arrayParentName: "toad" } }
       );
-      state.vtl.create({
+      craig.vtl.create({
         name: "toad",
         image: "7100-05-09",
         ssh_key: "test-key",
@@ -1210,38 +948,22 @@ describe("vtl", () => {
       });
 
       assert.deepEqual(
-        state.store.json.vtl,
-        [
-          {
-            name: "toad",
-            image: "7100-05-09",
-            ssh_key: "test-key",
-            network: [
-              {
-                name: "test-network",
-              },
-            ],
-            primary_subnet: null,
-            workspace: "toad",
-            zone: null,
-            pi_storage_type: null,
-          },
-        ],
+        craig.store.json.vtl[0].ssh_key,
+        "test-key",
         "it should initialize data"
       );
     });
     it("should update image when no longer in existing workspace", () => {
-      let state = newState();
-      state.power.create({
+      craig.power.create({
         name: "toad",
         images: [{ name: "7100-05-09", workspace: "toad" }],
         zone: "dal10",
       });
-      state.power.network.create(
+      craig.power.network.create(
         { name: "test-network" },
         { innerFormProps: { arrayParentName: "toad" } }
       );
-      state.vtl.create({
+      craig.vtl.create({
         name: "toad",
         image: "oops",
         ssh_key: "oops",
@@ -1259,32 +981,13 @@ describe("vtl", () => {
       });
 
       assert.deepEqual(
-        state.store.json.vtl,
-        [
-          {
-            name: "toad",
-            image: null,
-            ssh_key: null,
-            network: [
-              {
-                name: "test-network",
-              },
-            ],
-            primary_subnet: null,
-            workspace: "toad",
-            zone: null,
-            pi_storage_type: null,
-          },
-        ],
+        craig.store.json.vtl[0].image,
+        null,
         "it should initialize data"
       );
     });
   });
   describe("vtl.schema", () => {
-    let craig;
-    beforeEach(() => {
-      craig = newState();
-    });
     describe("vtl.pi_proc_type.hideWhen", () => {
       it("should hide when no workspace is selected or no vtl images", () => {
         assert.isTrue(